CVE-2009-4884 — MEDIUM (6.8)

Vulnerability Description

Multiple SQL injection vulnerabilities in phpCommunity 2 2.1.8, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via (1) the forum_id parameter in a forum action to index.php, (2) the topic_id parameter in a forum action to index.php, (3) the wert parameter in an id search action to index.php, (4) the wert parameter in a nick search action to index.php, or (5) the wert parameter in a forum search action to index.php, related to class_forum.php and class_search.php.

CVSS Score

6.8

MEDIUM

AV:N/AC:M/Au:N/C:P/I:P/A:P

Confidentiality

PARTIAL

Integrity

PARTIAL

Availability

PARTIAL

Affected Products

Vendor	Product	Versions
Bernhard Frohlich	Phpcom	2.1.8

Related Weaknesses (CWE)

CWE-89

References

FAQ

What is CVE-2009-4884?

CVE-2009-4884 is a vulnerability with a CVSS score of 6.8 (MEDIUM). Multiple SQL injection vulnerabilities in phpCommunity 2 2.1.8, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via (1) the forum_id parameter in a forum ac...

How severe is CVE-2009-4884?

CVE-2009-4884 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2009-4884?

Check the references section above for vendor advisories and patch information. Affected products include: Bernhard Frohlich Phpcom.