CVE-2009-4798

CVE-2009-4798 affects Diskos CMS 6.x, with multiple SQL injection flaws exposed via the (1) kat parameter to side.asp and (2) brugerid and (3) password fields in the administration login. The root cause is improper input handling allowing arbitrary SQL execution by remote attackers. The available...

CVE-2009-4799

Diskos CMS 6.x contains a vulnerability where sensitive data is stored under the web root with insufficient access control, allowing remote attackers to download the database via direct requests to artikler_prod.mdb or medlemmer.mdb. The issue is characterized by a network attack vector, low atta...