CVE-2009-1282

Опубликовано: 09 апр. 2009

Источник: nvd

CVSS2: 7.5

EPSS Низкий

Описание

SQL injection vulnerability in private/system/lib-session.php in glFusion 1.1.2 and earlier allows remote attackers to execute arbitrary SQL commands via the glf_session cookie parameter.

Ссылки

http://marc.info/?l=bugtraq&m=123877379105028&w=2
Exploit
http://osvdb.org/53286
http://retrogod.altervista.org/9sg_glfuso_sql_cookies.html
Exploit
http://secunia.com/advisories/34575
Vendor Advisory
http://www.glfusion.org/wiki/doku.php?id=glfusion:whatsnew
Patch
Vendor Advisory
http://www.securityfocus.com/bid/34361
Exploit
Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/49652
https://www.exploit-db.com/exploits/8347
http://marc.info/?l=bugtraq&m=123877379105028&w=2
Exploit
http://osvdb.org/53286
http://retrogod.altervista.org/9sg_glfuso_sql_cookies.html
Exploit
http://secunia.com/advisories/34575
Vendor Advisory
http://www.glfusion.org/wiki/doku.php?id=glfusion:whatsnew
Patch
Vendor Advisory
http://www.securityfocus.com/bid/34361
Exploit
Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/49652
https://www.exploit-db.com/exploits/8347

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:glfusion:glfusion:*:*:*:*:*:*:*:*

Версия до 1.1.2 (включая)

cpe:2.3:a:glfusion:glfusion:1.0.0:*:*:*:*:*:*:*

cpe:2.3:a:glfusion:glfusion:1.0.0:rc1:*:*:*:*:*:*

cpe:2.3:a:glfusion:glfusion:1.0.0:rc2:*:*:*:*:*:*

cpe:2.3:a:glfusion:glfusion:1.0.1:*:*:*:*:*:*:*

cpe:2.3:a:glfusion:glfusion:1.1.0:*:*:*:*:*:*:*

cpe:2.3:a:glfusion:glfusion:1.1.0:rc1:*:*:*:*:*:*

cpe:2.3:a:glfusion:glfusion:1.1.1:*:*:*:*:*:*:*

EPSS

Процентиль: 77%

0.01004

Низкий

7.5 High

CVSS2

Дефекты

CWE-89

Связанные уязвимости

GHSA-h29h-q852-5fjw

github

почти 4 года назад