Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2018-1000867: WeBid versions 1.2.2 and below: Auction database accessed by unauthorized users
CVE-2018-1000867 · published 7 years ago
Summary
Old versions of WeBid contain a security flaw that allows attackers to access sensitive information in the database. This could lead to unauthorized access to user data or auction information. Update WeBid to version 1.2.3 or later to fix this issue.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| webidsupport | webid |
<= 1.2.2 cpe:2.3:a:webidsupport:webid:*:*:*:*:*:*:*:* |
Original advisory text
WeBid version up to current version 1.2.2 contains a SQL Injection vulnerability in All five yourauctions*.php scripts that can result in Database Read via Blind SQL Injection. This attack appear t...
WeBid version up to current version 1.2.2 contains a SQL Injection vulnerability in All five yourauctions*.php scripts that can result in Database Read via Blind SQL Injection. This attack appear to be exploitable via HTTP Request. This vulnerability appears to have been fixed in after commit 256a5f9d3eafbc477dcf77c7682446cc4b449c7f.
References
- http://bugs.webidsupport.com/view.php?id=647 Issue Tracking Release Notes Vendor Advisory
- https://github.com/renlok/WeBid/commit/256a5f9d3eafbc477dcf77c7682446cc4b449c7f Patch
- https://telekomsecurity.github.io/assets/advisories/20181108_WeBid_Multiple_Vuln... Exploit Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-89SQL Injection
Timeline
Published20 Dec 2018
Updated31 Oct 2026
First seen8 Jul 2026
Track software like this
Free during beta