CVEvulnerability
CVE-2009-2010
6.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2009-06-08
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-89
Description
Multiple SQL injection vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 1.9 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) thread parameter to messageboard.php, (2) member parameter to profile.php, (3) pid parameter to gallery/index.php, and the (4) fcms_login_id cookie parameter.
Affected configurations
• haudenschilt family connections cms (<= 1.9)
• haudenschilt family connections cms 0.1.1
• haudenschilt family connections cms 0.1.2
• haudenschilt family connections cms 0.5
• haudenschilt family connections cms 0.6
• haudenschilt family connections cms 0.8
• haudenschilt family connections cms 0.9
• haudenschilt family connections cms 1.4
• haudenschilt family connections cms 1.8.1
• haudenschilt family connections cms 1.8.2
Related
Weakness · CWE (1)
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness
References
- http://secunia.com/advisories/35039 Vendor Advisory
- http://www.securityfocus.com/archive/1/503477/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/34935 Exploit
- http://www.vupen.com/english/advisories/2009/1306 Vendor Advisory
- https://www.exploit-db.com/exploits/8671 www.exploit-db.com
- http://secunia.com/advisories/35039 Vendor Advisory
- http://www.securityfocus.com/archive/1/503477/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/34935 Exploit
- http://www.vupen.com/english/advisories/2009/1306 Vendor Advisory
- https://www.exploit-db.com/exploits/8671 www.exploit-db.com