PT-2010-1741 · Com Jvideo · Jvideo!
Chip D3 Bi0S
·
Published
2010-07-22
·
Updated
2017-09-19
·
CVE-2009-4938
CVSS v2.0
7.5
High
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
JVideo! (com jvideo) versions 0.3.11c Beta through 0.3.x
Description
The issue allows remote attackers to execute arbitrary SQL commands via the
user id parameter in a user action to "index.php".Recommendations
For versions 0.3.11c Beta through 0.3.x, avoid using the
user id parameter in the affected API endpoint until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Jvideo!