PT-2009-4822 · Mr.Saphp · Mr.Saphp Arabic Script Mobile+1

Black Dream · Published 2009-07-09 · Updated 2017-09-19 · CVE-2009-2394

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SMSPages version 1.0 in Mr.Saphp Arabic Script Mobile (aka Messages Library) version 2.0

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the CatID parameter in the "cat.php" file.

Recommendations For SMSPages version 1.0 in Mr.Saphp Arabic Script Mobile (aka Messages Library) version 2.0, avoid using the CatID parameter in the "cat.php" file until the issue is resolved. Restrict access to the "cat.php" file to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2009-2394

Affected Products

Mr.Saphp Arabic Script Mobile

Smspages

References · 3

• 🔥 http://exploit-db.com/exploits/9027 · Exploit
• 🔥 https://exploit-db.com/exploits/9027 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-2394 · Security Note