PT-2009-5569 · Rash · Rqms

Published 2009-09-18 · Updated 2017-08-17 · CVE-2009-3255

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions RASH Quote Management System (RQMS) versions 1.2.2 and earlier

Description The issue allows remote attackers to execute arbitrary SQL commands via the user parameter in an admin action to the default URI, when magic quotes gpc is disabled.

Recommendations For RASH Quote Management System (RQMS) versions 1.2.2 and earlier, consider disabling the user parameter in the admin action until a patch is available, or enable magic quotes gpc to prevent SQL injection attacks.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2009-3255

Affected Products

Rqms

References · 6

• 🔥 http://packetstormsecurity.org/0908-exploits/rqms-bypass.txt · Exploit
• http://secunia.com/advisories/36477 · Vendor Advisory
• http://vupen.com/english/advisories/2009/2446 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-3255 · Security Note
• http://osvdb.org/57468 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/52895 · Note