Lucene search

[email protected]CVE-2009-3259

HistorySep 18, 2009 - 9:30 p.m.

CVE-2009-3259

2009-09-1821:30:00

CWE-89

[email protected]

web.nvd.nist.gov

cve

sql injection

rash quote management system

rqms 1.2.2

remote attackers

nvd

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

8.3 High

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

61.3%

JSON

Multiple SQL injection vulnerabilities in RASH Quote Management System (RQMS) 1.2.2 allow remote attackers to execute arbitrary SQL commands via (1) the search parameter in a search action, (2) the quote parameter in a quote addition, or (3) a User_Name cookie in unspecified administrative actions. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

Affected configurations

NVD

Node

thomas_cuchtarashMatch1.2.2

CPENameOperatorVersion
thomas_cuchta:rashthomas cuchta rasheq1.2.2

CPE	Name	Operator	Version
thomas_cuchta:rash	thomas cuchta rash	eq	1.2.2

References

osvdb.org/57467

osvdb.org/57469

osvdb.org/57470

secunia.com/advisories/36477

exchange.xforce.ibmcloud.com/vulnerabilities/52895

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

8.3 High

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

61.3%

JSON

Related for CVE-2009-3259

prion1 nvd1 cvelist1