CVE-2009-3418

2009-09-2522:00:00

mitre

www.cve.org

plume cms

sql injection

remote authenticated users

remote authenticated administrators

arbitrary sql commands

AI Score

8.1

Confidence

Low

EPSS

0.001

Percentile

44.0%

JSON

Multiple SQL injection vulnerabilities in Plume CMS 1.2.3 allow (1) remote authenticated users to execute arbitrary SQL commands via the m parameter to manager/index.php and (2) remote authenticated administrators to execute arbitrary SQL commands via the id parameter in an edit_link action to manager/tools.php. NOTE: some of these details are obtained from third party information.