CVE-2009-0458

Multiple SQL injection vulnerabilities in admin/login_submit.php in Whole Hog Ware Support 1.x allow remote attackers to execute arbitrary SQL commands via (1) the uid parameter (aka Username field) or (2) the pwd parameter (aka Password field). NOTE: some of these details are obtained from third party information.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://osvdb.org/51733
http://secunia.com/advisories/33777	Vendor Advisory
http://www.securityfocus.com/bid/33564	Exploit
https://www.exploit-db.com/exploits/7940
http://osvdb.org/51733
http://secunia.com/advisories/33777	Vendor Advisory
http://www.securityfocus.com/bid/33564	Exploit
https://www.exploit-db.com/exploits/7940

Configurations

Configuration 1 (hide)

cpe:2.3:a:wholehogsoftware:ware_support:1.0:*:*:*:*:*:*:*

History

21 Nov 2024, 00:59

Type	Values Removed	Values Added
References	~~() http://osvdb.org/51733 -~~	() http://osvdb.org/51733 -
References	~~() http://secunia.com/advisories/33777 - Vendor Advisory~~	() http://secunia.com/advisories/33777 - Vendor Advisory
References	~~() http://www.securityfocus.com/bid/33564 - Exploit~~	() http://www.securityfocus.com/bid/33564 - Exploit
References	~~() https://www.exploit-db.com/exploits/7940 -~~	() https://www.exploit-db.com/exploits/7940 -

Information

Published : 2009-02-10 07:00

Updated : 2024-11-21 00:59

NVD link : CVE-2009-0458

Mitre link : CVE-2009-0458

CVE.ORG link : CVE-2009-0458

JSON object : View

Products Affected

wholehogsoftware

ware_support

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2009-0458", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}]}, "published": "2009-02-10T07:00:24.017", "references": [{"url": "http://osvdb.org/51733", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/33777", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/33564", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "https://www.exploit-db.com/exploits/7940", "source": "cve@mitre.org"}, {"url": "http://osvdb.org/51733", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://secunia.com/advisories/33777", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/33564", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.exploit-db.com/exploits/7940", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "Multiple SQL injection vulnerabilities in admin/login_submit.php in Whole Hog Ware Support 1.x allow remote attackers to execute arbitrary SQL commands via (1) the uid parameter (aka Username field) or (2) the pwd parameter (aka Password field). NOTE: some of these details are obtained from third party information."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades SQL en admin/login_submit.php de Whole Hog Ware Support v1.x, permite a atacantes remotos la ejecuci\u00f3n de comandos SQL de su elecci\u00f3n a trav\u00e9s de los par\u00e1metros (1)\"uid\" (tambi\u00e9n conocido como campo nombre de usuario) o(2)\"pwd\" (tambi\u00e9n conocido como campo password). NOTA: Algunos detalles han sido obtenidos a partir de terceros."}], "lastModified": "2024-11-21T00:59:57.047", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wholehogsoftware:ware_support:1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F1BC1693-6008-46BA-A13B-E5FAECA7C94D"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}