CVEvulnerability

CVE-2009-0402

7.5 HIGH Published 2009-02-03 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2009-02-03
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-89

Description

SQL injection vulnerability in client/new_account.php in Domain Technologie Control (DTC) before 0.29.16 allows remote attackers to execute arbitrary SQL commands via the (1) familyname, (2) christname, (3) company_name, (4) is_company, (5) email, (6) phone, (7) fax, (8) addr1, (9) addr2, (10) addr3, (11) zipcode, (12) city, (13) state, (14) country, and (15) vat_num parameters.

Affected configurations

• gplhost domain technologie control (<= 0.29.8) • gplhost domain technologie control 0.26.7 • gplhost domain technologie control 0.26.8 • gplhost domain technologie control 0.26.9 • gplhost domain technologie control 0.27.3 • gplhost domain technologie control 0.28.2 • gplhost domain technologie control 0.28.3 • gplhost domain technologie control 0.28.10 • gplhost domain technologie control 0.29.1

Related

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References