PT-2009-3909 · Cre Loaded · Cre Loaded

Player · Published 2009-04-24 · Updated 2017-09-29 · CVE-2009-1403

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions CRE Loaded version 6.2

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the products id parameter in the "product info.php" file.

Recommendations For CRE Loaded version 6.2, consider restricting access to the product info.php file or validating and sanitizing the products id parameter to prevent SQL injection attacks. As a temporary workaround, avoid using the products id parameter in the affected file until a patch is available.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2009-1403

Affected Products

Cre Loaded

References · 4

• 🔥 https://exploit-db.com/exploits/8501 · Exploit
• 🔥 http://securityfocus.com/bid/34640 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-1403 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/49987 · Note