Roomphplanning · Roomphplanning · CVE-2009-4669
**Name of the Vulnerable Software and Affected Versions**
RoomPHPlanning version 1.6
**Description**
The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the `loginus` parameter to "Login.php" or the "Old Password" field to "changepwd.php". Additionally, remote authenticated administrators can execute arbitrary SQL commands via the `id` parameter to "admin/userform.php".
**Recommendations**
For RoomPHPlanning version 1.6, consider restricting access to the "Login.php" and "changepwd.php" scripts until a patch is available. As a temporary workaround, restrict the use of the `loginus` parameter and the "Old Password" field. Also, limit access to the "admin/userform.php" script for authenticated administrators and avoid using the `id` parameter until the issue is resolved.