CVE-2010-1092 in Business Directory Software
Summary
by MITRE
Multiple SQL injection vulnerabilities in login.php in ScriptsFeed Business Directory Software allow remote attackers to execute arbitrary SQL commands via the (1) us and (2) ps parameters.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 05/03/2026
The vulnerability identified as CVE-2010-1092 represents a critical SQL injection flaw within the ScriptsFeed Business Directory Software platform, specifically affecting the login.php script. This vulnerability resides in the authentication mechanism of the software, making it a prime target for attackers seeking unauthorized access to the system. The flaw manifests through two distinct parameter inputs named us and ps, which are processed without adequate sanitization or validation, creating an exploitable entry point for malicious actors.
The technical implementation of this vulnerability stems from the software's failure to properly escape or parameterize user input before incorporating it into SQL query constructions. When attackers provide malicious input through the us and ps parameters, the application directly concatenates these values into database queries without appropriate security measures such as prepared statements or input sanitization. This design flaw falls under the Common Weakness Enumeration category CWE-89, which specifically addresses SQL injection vulnerabilities where untrusted data is incorporated into SQL commands without proper escaping or parameterization.
The operational impact of this vulnerability extends beyond simple data theft, as it enables attackers to execute arbitrary SQL commands against the underlying database system. Successful exploitation could result in complete database compromise, allowing threat actors to extract sensitive information, modify or delete records, and potentially escalate privileges within the application. The vulnerability's remote nature means that attackers can exploit it from outside the network perimeter, eliminating the need for local access or network reconnaissance. This characteristic aligns with ATT&CK technique T1190, which describes the exploitation of remote services through injection attacks.
The business directory software environment presents additional risks as these vulnerabilities could be leveraged to access customer data, business listings, user credentials, and other sensitive information stored within the database. Attackers might also use this vulnerability to inject malicious code or establish persistent access points within the compromised system. The vulnerability's presence in a directory software platform suggests potential exposure of business contact information, which could facilitate further social engineering attacks or data monetization efforts.
Mitigation strategies for CVE-2010-1092 should focus on immediate input validation and sanitization implementation. The most effective approach involves transitioning from dynamic SQL query construction to prepared statements or parameterized queries that separate user input from SQL command structure. Additionally, implementing proper input filtering, output encoding, and least privilege database access controls would significantly reduce the exploitation risk. Regular security audits and penetration testing should be conducted to identify similar vulnerabilities in other application components, while application firewalls and intrusion detection systems can help detect potential exploitation attempts. The vulnerability serves as a reminder of the critical importance of secure coding practices and the necessity of following established security frameworks such as OWASP Top Ten and NIST guidelines for preventing injection vulnerabilities in web applications.