Lucene search

K
cve[email protected]CVE-2009-2385
HistoryJul 08, 2009 - 3:30 p.m.

CVE-2009-2385

2009-07-0815:30:01
CWE-89
web.nvd.nist.gov
23
sql injection
member awards component
simple machines forum
smf
remote attackers
arbitrary sql commands

8.6 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

27.7%

SQL injection vulnerability in the awardsMembers function in Sources/Profile.php in the Member Awards component 1.0.2 for Simple Machines Forum (SMF) allows remote attackers to execute arbitrary SQL commands via the id parameter in a profile action to index.php. NOTE: some of these details are obtained from third party information.

Affected configurations

NVD
Node
simple_machinessmf
AND
fustratemember_awardsMatch1.0.2

8.6 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

27.7%

Related for CVE-2009-2385