CVE-2009-2123

Multiple SQL injection vulnerabilities in Elvin 1.2.0 allow remote attackers to execute arbitrary SQL commands via the (1) inUser (aka Username) and (2) inPass (aka Password) parameters to (a) inc/login.ei, reachable through login.php; and the (3) id parameter to (b) show_bug.php and (c) show_activity.php. NOTE: it was later reported that vector 3c also affects 1.2.2.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://secunia.com/advisories/35486	Vendor Advisory
https://www.exploit-db.com/exploits/8953
https://www.exploit-db.com/exploits/9342
http://secunia.com/advisories/35486	Vendor Advisory
https://www.exploit-db.com/exploits/8953
https://www.exploit-db.com/exploits/9342

Configurations

Configuration 1 (hide)

cpe:2.3:a:elvinbts:elvinbts:1.2.0:*:*:*:*:*:*:*

History

21 Nov 2024, 01:04

Type	Values Removed	Values Added
References	~~() http://secunia.com/advisories/35486 - Vendor Advisory~~	() http://secunia.com/advisories/35486 - Vendor Advisory
References	~~() https://www.exploit-db.com/exploits/8953 -~~	() https://www.exploit-db.com/exploits/8953 -
References	~~() https://www.exploit-db.com/exploits/9342 -~~	() https://www.exploit-db.com/exploits/9342 -

Information

Published : 2009-06-19 18:00

Updated : 2024-11-21 01:04

NVD link : CVE-2009-2123

Mitre link : CVE-2009-2123

CVE.ORG link : CVE-2009-2123

JSON object : View

Products Affected

elvinbts

elvinbts

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2009-2123", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2009-06-19T18:00:00.203", "references": [{"url": "http://secunia.com/advisories/35486", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.exploit-db.com/exploits/8953", "source": "cve@mitre.org"}, {"url": "https://www.exploit-db.com/exploits/9342", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/35486", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.exploit-db.com/exploits/8953", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.exploit-db.com/exploits/9342", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "Multiple SQL injection vulnerabilities in Elvin 1.2.0 allow remote attackers to execute arbitrary SQL commands via the (1) inUser (aka Username) and (2) inPass (aka Password) parameters to (a) inc/login.ei, reachable through login.php; and the (3) id parameter to (b) show_bug.php and (c) show_activity.php. NOTE: it was later reported that vector 3c also affects 1.2.2."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de inyecci\u00f3n SQL en Elvin versi\u00f3n 1.2.0, permiten a los atacantes remotos ejecutar comandos SQL arbitrarios por medio de los par\u00e1metros (1) inUser (tambi\u00e9n se conoce como nombre de usuario) y (2) inPass (tambi\u00e9n se conoce como contrase\u00f1a) en (a) archivo inc/login.ei, accesible por medio del archivo login.php; y el par\u00e1metro (3) id en los archivos (b) show_bug.php y (c) show_activity.php. NOTA: m\u00e1s tarde se inform\u00f3 que el vector 3c tambi\u00e9n afecta a la versi\u00f3n 1.2.2."}], "lastModified": "2024-11-21T01:04:10.957", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:elvinbts:elvinbts:1.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "84469C04-A695-4041-8D07-C0B429B4C8CA"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}