PT-2010-1616 · Graugon · Graugon Php Article Publisher

X0R · Published 2010-04-23 · Updated 2017-09-19 · CVE-2009-4807

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Graugon PHP Article Publisher version 1.0

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the c parameter to "index.php" and the id parameter to "view.php".

Recommendations For Graugon PHP Article Publisher version 1.0, consider validating and sanitizing user input for the c parameter in "index.php" and the id parameter in "view.php" to prevent SQL injection attacks. As a temporary workaround, restrict access to "index.php" and "view.php" to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2009-4807

Affected Products

Graugon Php Article Publisher

References · 6

• 🔥 http://exploit-db.com/exploits/8133 · Exploit
• 🔥 https://exploit-db.com/exploits/8133 · Exploit
• 🔥 http://securityfocus.com/bid/33952 · Exploit
• http://secunia.com/advisories/34126 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-4807 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/49031 · Note