CVE-2009-3255

Опубликовано: 18 сент. 2009

Источник: nvd

CVSS2: 6.8

EPSS Низкий

Описание

SQL injection vulnerability in RASH Quote Management System (RQMS) 1.2.2 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the user parameter in an admin action to the default URI.

Ссылки

http://osvdb.org/57468
http://packetstormsecurity.org/0908-exploits/rqms-bypass.txt
Exploit
http://secunia.com/advisories/36477
Vendor Advisory
http://www.vupen.com/english/advisories/2009/2446
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/52895
http://osvdb.org/57468
http://packetstormsecurity.org/0908-exploits/rqms-bypass.txt
Exploit
http://secunia.com/advisories/36477
Vendor Advisory
http://www.vupen.com/english/advisories/2009/2446
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/52895

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:thomas_cuchta:rash:*:*:*:*:*:*:*:*

Версия до 1.2.2 (включая)

cpe:2.3:a:thomas_cuchta:rash:1.0:*:*:*:*:*:*:*

cpe:2.3:a:thomas_cuchta:rash:1.1:*:*:*:*:*:*:*

cpe:2.3:a:thomas_cuchta:rash:1.1.1:*:*:*:*:*:*:*

cpe:2.3:a:thomas_cuchta:rash:1.1.2:*:*:*:*:*:*:*

cpe:2.3:a:thomas_cuchta:rash:1.1.3:*:*:*:*:*:*:*

cpe:2.3:a:thomas_cuchta:rash:1.2:*:*:*:*:*:*:*

cpe:2.3:a:thomas_cuchta:rash:1.2.1:*:*:*:*:*:*:*

EPSS

Процентиль: 62%

0.00435

Низкий

6.8 Medium

CVSS2

Дефекты

CWE-89

Связанные уязвимости

GHSA-pgc6-mrqp-hqww

github

почти 4 года назад