PT-2009-5864 · Sql Ledger+1 · Sql-Ledger+1

Published 2009-12-23 · Updated 2018-10-10 · CVE-2009-3581

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions SQL-Ledger version 2.8.24

Description The issue allows remote authenticated users to inject arbitrary web script or HTML via specific fields, including the DCN Description field in the Accounts Receivables menu item for Add Transaction, the Description field in the Accounts Payable menu item for Add Transaction, the name field in the Customers menu item for Add Customer, or the Vendor menu item for Add Vendor.

Recommendations For SQL-Ledger version 2.8.24, consider restricting access to the affected fields, such as the DCN Description field, the Description field, and the name fields in the Customers and Vendor menu items, until a patch is available. As a temporary workaround, avoid using these fields for input that may contain web script or HTML.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2009-3581

Affected Products

Debian

Sql-Ledger

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2009-3581 · Security Note
• http://secunia.com/advisories/37877 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2009-3581 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-3581 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2009-3581 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2009-3581 · Security Note
• https://security-tracker.debian.org/tracker/source-package/sql-ledger · Vendor Advisory
• https://ubuntu.com/security/CVE-2009-3581 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3581 · Security Note
• https://osv.dev/vulnerability/CVE-2009-3581 · Vendor Advisory
• http://securityfocus.com/archive/1/508559/100/0/threaded · Note
• https://packages.debian.org/src:sql-ledger · Note
• http://securityfocus.com/bid/37431 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54965 · Note