CVE-2009-3218 - SQL injection vulnerability in control/login.php in AR Web Content Manager (AWCM) 2.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the username parameter

Back Back to CVE browser

MEDIUM

SQL injection vulnerability in control/login.php in AR Web Content Manager (AWCM) 2.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the username parameter

Published Sep 16, 2009

6.8

MEDIUM

CVSS 2.0

EPSS 1.98%

Description

SQL injection vulnerability in control/login.php in AR Web Content Manager (AWCM) 2.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the username parameter.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (5)

http://osvdb.org/56338
vdb-entryx_refsource_OSVDB
http://secunia.com/advisories/35955
third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://www.exploit-db.com/exploits/9237
exploitx_refsource_EXPLOIT-DB
https://euvd.enisa.europa.eu/vulnerability/EUVD-2009-3201
Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/51980
vdb-entryx_refsource_XF

Link	Providers	Tags
http://osvdb.org/56338		vdb-entryx_refsource_OSVDB
http://secunia.com/advisories/35955		third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://www.exploit-db.com/exploits/9237		exploitx_refsource_EXPLOIT-DB
https://euvd.enisa.europa.eu/vulnerability/EUVD-2009-3201		Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/51980		vdb-entryx_refsource_XF