CVEvulnerability
CVE-2009-4437
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2009-12-28
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-89
Description
Multiple SQL injection vulnerabilities in Active Auction House 3.6 allow remote attackers to execute arbitrary SQL commands via the (1) catid parameter to wishlist.asp and the (2) linkid parameter to links.asp. NOTE: vector 1 might overlap CVE-2005-1029.1.
Affected configurations
• activewebsoftwares active auction house 3.6
Related
Weakness · CWE (1)
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness
References
- http://packetstormsecurity.org/0912-exploits/activeauctionhouse-sql.txt Exploit
- http://secunia.com/advisories/14839 Vendor Advisory
- http://www.exploit-db.com/exploits/10520 Exploit
- http://www.securityfocus.com/bid/37401 Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/54891 exchange.xforce.ibmcloud.com
- http://packetstormsecurity.org/0912-exploits/activeauctionhouse-sql.txt Exploit
- http://secunia.com/advisories/14839 Vendor Advisory
- http://www.exploit-db.com/exploits/10520 Exploit
- http://www.securityfocus.com/bid/37401 Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/54891 exchange.xforce.ibmcloud.com