Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2010-0690: CommodityRentals Video Games Rentals lets attackers run database code

CVE-2010-0690 · published 16 years ago

Summary

The web page index.php in CommodityRentals Video Games Rentals can be tricked into running malicious database commands when a specially crafted value is sent in the pfid field. This could let an attacker read, change, or delete data stored by the application. Apply the vendor's update or patch the code to properly validate the pfid input as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
commodityrentals	video_games_rentals	All versions `cpe:2.3:a:commodityrentals:video_games_rentals::::::::`

Original advisory text

SQL injection vulnerability in index.php in CommodityRentals Video Games Rentals allows remote attackers to execute arbitrary SQL commands via the pfid parameter in a catalog action.

References

http://osvdb.org/62295
http://packetstormsecurity.org/1002-exploits/videogamesrental-sql.txt Exploit
http://secunia.com/advisories/38555 Vendor Advisory
http://www.exploit-db.com/exploits/11409 Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/56226

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Exploitation

1% chance of attack within 30 days

Type

CWE-89SQL Injection

Timeline

Published23 Feb 2010

Updated31 Oct 2026

First seen29 Sep 2026

Sources

CVE-2010-0690 · NVD

Track software like this

Free during beta