PT-2009-3752 · Auth2Db · Auth2Db

Steffen Joeris · Published 2009-04-01 · Updated 2017-08-17 · CVE-2009-1208

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions auth2db versions 0.2.5 through 0.2.6

Description The issue allows remote attackers to conduct SQL injection attacks using multibyte character encodings due to the use of the addslashes function instead of the mysql real escape string function.

Recommendations For versions 0.2.5 through 0.2.6, update to version 0.2.7 or later to resolve the issue.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2009-1208

DSA-1757-1

Affected Products

Auth2Db

References · 7

• http://secunia.com/advisories/34488 · Vendor Advisory
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=521823 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2009-1208 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/49518 · Note
• http://securityfocus.com/bid/34287 · Note
• http://debian.org/security/2009/dsa-1757 · Patch, Vendor Advisory
• http://auth2db.com.ar/?title=CHANGELOG · Note