CVE-2009-3118 - SQL injection vulnerability in mod/poll/comment.php in the vote module in Danneo CMS 0.5.2 and earlier allows remote attackers to execute arbitrary SQL commands via the comtext parameter, in conjunction with crafted comname and comtitle parameters, in a poll action to index.php, related to incorrect input sanitization in base/danneo.function.php

Back Back to CVE browser

HIGH

SQL injection vulnerability in mod/poll/comment.php in the vote module in Danneo CMS 0.5.2 and earlier allows remote attackers to execute arbitrary SQL commands via the comtext parameter, in conjunction with crafted comname and comtitle parameters, in a poll action to index.php, related to incorrect input sanitization in base/danneo.function.php

Published Sep 9, 2009

7.5

HIGH

CVSS 2.0

EPSS 1.16%

Description

SQL injection vulnerability in mod/poll/comment.php in the vote module in Danneo CMS 0.5.2 and earlier allows remote attackers to execute arbitrary SQL commands via the comtext parameter, in conjunction with crafted comname and comtitle parameters, in a poll action to index.php, related to incorrect input sanitization in base/danneo.function.php.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (4)

http://packetstormsecurity.org/0908-exploits/danneo052-sql.txt
x_refsource_MISCExploit
http://secunia.com/advisories/36440
third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://www.vupen.com/english/advisories/2009/2459
vdb-entryx_refsource_VUPENVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2009-3101
Advisory

Link	Providers	Tags
http://packetstormsecurity.org/0908-exploits/danneo052-sql.txt		x_refsource_MISCExploit
http://secunia.com/advisories/36440		third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://www.vupen.com/english/advisories/2009/2459		vdb-entryx_refsource_VUPENVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2009-3101		Advisory