PT-2009-4768 · W3B · W3B|Cms Gaestebuch Guestbook Module

Dnx · Published 2009-07-07 · Updated 2017-09-19 · CVE-2009-2337

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions w3b|cms Gaestebuch Guestbook Module version 3.0.0

Description The issue allows remote attackers to execute arbitrary SQL commands. This is possible due to a SQL injection vulnerability when the magic quotes gpc setting is disabled. The vulnerability can be exploited via the spam id parameter.

Recommendations For version 3.0.0, consider disabling the includes/module/book/index.inc.php module until a patch is available, or restrict access to it to minimize the risk of exploitation. Avoid using the spam id parameter in the affected module until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2009-2337

Affected Products

W3B|Cms Gaestebuch Guestbook Module

References · 8

• 🔥 https://exploit-db.com/exploits/8396 · Exploit
• 🔥 http://exploit-db.com/exploits/8396 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-2337 · Security Note
• http://osvdb.org/53614 · Patch
• http://secunia.com/advisories/34650 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/49853 · Note
• http://w3bcms.de/2.news/54.kommentare · Note
• http://securityfocus.com/bid/34477 · Note