CVE-2009-3040

2009-09-0118:30:03

Debian Security Bug Tracker

security-tracker.debian.org

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

28.0%

JSON

Multiple SQL injection vulnerabilities in Open Computer and Software (OCS) Inventory NG 1.02 for Unix allow remote attackers to execute arbitrary SQL commands via the (1) N, (2) DL, (3) O and (4) V parameters to download.php and the (5) SYSTEMID parameter to group_show.php.

OSVersionArchitecturePackageVersionFilename
Debian12allocsinventory-server< 1.02.1-2ocsinventory-server_1.02.1-2_all.deb
Debian11allocsinventory-server< 1.02.1-2ocsinventory-server_1.02.1-2_all.deb
Debian999allocsinventory-server< 1.02.1-2ocsinventory-server_1.02.1-2_all.deb
Debian13allocsinventory-server< 1.02.1-2ocsinventory-server_1.02.1-2_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	ocsinventory-server	< 1.02.1-2	ocsinventory-server_1.02.1-2_all.deb
Debian	11	all	ocsinventory-server	< 1.02.1-2	ocsinventory-server_1.02.1-2_all.deb
Debian	999	all	ocsinventory-server	< 1.02.1-2	ocsinventory-server_1.02.1-2_all.deb
Debian	13	all	ocsinventory-server	< 1.02.1-2	ocsinventory-server_1.02.1-2_all.deb