PT-2010-1414 · Php · Php Inventory

Published 2010-01-12 · Updated 2010-01-13 · CVE-2009-4595

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHP Inventory version 1.2

Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the sup id parameter in a suppliers details action in the index.php file.

Recommendations For PHP Inventory version 1.2, consider restricting access to the sup id parameter in the suppliers details action until a patch is available. As a temporary workaround, avoid using the sup id parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2009-4595

Affected Products

Php Inventory

References · 3

• 🔥 https://exploit-db.com/exploits/10370 · Exploit
• http://secunia.com/advisories/37672 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-4595 · Security Note