CVE-2009-3040 - ocsinventory: multiple SQL injection vulnerabilities

Back Back to CVE browser

HIGH

ocsinventory: multiple SQL injection vulnerabilities

Published Sep 1, 2009

7.5

HIGH

CVSS 2.0

EPSS 1.42%

Description

Multiple SQL injection vulnerabilities in Open Computer and Software (OCS) Inventory NG 1.02 for Unix allow remote attackers to execute arbitrary SQL commands via the (1) N, (2) DL, (3) O and (4) V parameters to download.php and the (5) SYSTEMID parameter to group_show.php.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (8)

http://www.leidecker.info/advisories/2009-05-30-ocs_inventory_ng_sql_injection.shtml
x_refsource_MISCExploit
http://www.ocsinventory-ng.org/index.php?mact=News%2Ccntnt01%2Cdetail%2C0&cntnt01articleid=140&cntnt01returnid=72
x_refsource_CONFIRM
http://www.securityfocus.com/archive/1/503936/100/0/threaded
mailing-listx_refsource_BUGTRAQ
https://access.redhat.com/security/cve/CVE-2009-3040
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=520687
Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2009-3024
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2009-3040
https://www.cve.org/CVERecord?id=CVE-2009-3040

Link	Providers	Tags
http://www.leidecker.info/advisories/2009-05-30-ocs_inventory_ng_sql_injection.shtml		x_refsource_MISCExploit
http://www.ocsinventory-ng.org/index.php?mact=News%2Ccntnt01%2Cdetail%2C0&cntnt01articleid=140&cntnt01returnid=72		x_refsource_CONFIRM
http://www.securityfocus.com/archive/1/503936/100/0/threaded		mailing-listx_refsource_BUGTRAQ
https://access.redhat.com/security/cve/CVE-2009-3040		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=520687		Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2009-3024		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2009-3040
https://www.cve.org/CVERecord?id=CVE-2009-3040