Lucene search
HistoryJul 05, 2009 - 4:30 p.m.
CVE-2009-2328
cve-2009-2328
kervinet forum
sql injection
remote account deletion
authentication
vulnerability
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
8 High
AI Score
Confidence
Low
0.001 Low
EPSS
Percentile
45.1%
admin/edit_user.php in KerviNet Forum 1.1 and earlier does not require administrative authentication, which allows remote attackers to delete arbitrary accounts and conduct SQL injection attacks via the del_user_id parameter.
Affected configurations
Node
max_kervinkervinet_forumRange≤1.1
| CPE | Name | Operator | Version |
|---|---|---|---|
| max_kervin:kervinet_forum | max kervin kervinet forum | le | 1.1 |
References
Related
prion
prion
Sql injection
2009-07-05 16:30:00
nvd
nvd
CVE-2009-2328
2009-07-05 16:30:00
cvelist
cvelist
CVE-2009-2328
2009-07-05 16:00:00
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
8 High
AI Score
Confidence
Low
0.001 Low
EPSS
Percentile
45.1%
Related for CVE-2009-2328