VULNERABILITY INTELLIGENCE

CVE-2018-1000867

CVSS score8.8 HIGH

EPSS probability1.46%

CISA KEVNot currently listed

Published2018-12-20

Last modified2026-06-17

CVSS vectorCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

WeBid version up to current version 1.2.2 contains a SQL Injection vulnerability in All five yourauctions*.php scripts that can result in Database Read via Blind SQL Injection. This attack appear to be exploitable via HTTP Request. This vulnerability appears to have been fixed in after commit 256a5f9d3eafbc477dcf77c7682446cc4b449c7f.

Weakness classification

nvd@nist.gov: CWE-89

Primary references

cve@mitre.org — Issue Tracking, Release Notes, Vendor Advisory
cve@mitre.org — Patch
cve@mitre.org — Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Release Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Patch
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory