PT-2009-5794 · Bpowerhouse · Bpowerhouse Bpmusic

Published 2009-09-30 · Updated 2009-10-01 · CVE-2009-3502

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions BPowerHouse BPMusic version 1.0

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the music id parameter in the "music.php" file.

Recommendations For BPowerHouse BPMusic version 1.0, consider restricting access to the music.php file or validating and sanitizing the music id parameter to prevent SQL injection attacks. As a temporary workaround, avoid using the music id parameter in the music.php file until a patch is available.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2009-3502

Affected Products

Bpowerhouse Bpmusic

References · 5

• 🔥 https://exploit-db.com/exploits/9836 · Exploit
• 🔥 http://packetstormsecurity.org/0909-exploits/bpmusic-sql.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-3502 · Security Note
• http://vupen.com/english/advisories/2009/2740 · Vendor Advisory
• http://secunia.com/advisories/36824 · Vendor Advisory