PT-2009-3915 · E107 · E107

Juri Gianni + 1 · Publicado 2009-04-24 · Atualizado 2017-09-29 · CVE-2009-1409

NVD

CVSS v2.0

5.1

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:P

SQL injection vulnerability in usersettings.php in e107 0.7.15 and earlier, when "Extended User Fields" is enabled and magic quotes gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the hide parameter, a different vector than CVE-2005-4224 and CVE-2008-5320.

Exploit

Correção

RCE

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2009-1409

Produtos afetados

E107

Referências · 7

• 🔥 https://exploit-db.com/exploits/8495 · Exploit
• http://osvdb.org/53812 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1409 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/49981 · Nota
• http://securityfocus.com/bid/34614 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-1409 · Nota de Segurança
• http://secunia.com/advisories/34823 · Aviso do Fabricante