CVE-2009-0646
Last modified
CVE-2009-0646 is a vulnerability of currently unknown severity. Multiple SQL injection vulnerabilities in 4Site CMS 2.6 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) login and (2) password parameters to pcgi/4site.pl, (3) page parameter to print/print.shtml, (4) s and (5) i parameters to portfolio/index.shtml, (6) h parameter to hotel/index.php, (7) id parameter to news/news1.shtml, and the (8) th parameter to faq/index.shtml.. EPSS estimates a 3.60% chance of exploitation in the next 30 days.
Description
Multiple SQL injection vulnerabilities in 4Site CMS 2.6 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) login and (2) password parameters to pcgi/4site.pl, (3) page parameter to print/print.shtml, (4) s and (5) i parameters to portfolio/index.shtml, (6) h parameter to hotel/index.php, (7) id parameter to news/news1.shtml, and the (8) th parameter to faq/index.shtml.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| 4site | 4site Cms | <= 2.6 |
References
- http://secunia.com/advisories/33733Vendor Advisory
- http://secunia.com/advisories/33733Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2009-0646?
How severe is CVE-2009-0646?
How do I fix CVE-2009-0646?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2009
- CVE-2009-0640Directory traversal vulnerability in the administrative web …
- CVE-2009-0641sys_term.c in telnetd in FreeBSD 7.0-RELEASE and other 7.x v…
- CVE-2009-0642ext/openssl/ossl_ocsp.c in Ruby 1.8 and 1.9 does not properl…
- CVE-2009-0643Static code injection vulnerability in post.php in Simple PH…
- CVE-2009-0644The HTTP interface in Swann DVR4-SecuraNet has a certain def…
- CVE-2009-0645Directory traversal vulnerability in index.php in Jaws 0.8.8…
- CVE-2009-0647msnmsgr.exe in Windows Live Messenger (WLM) 2009 build 14.0.…
- CVE-2009-0648Multiple cross-site request forgery (CSRF) vulnerabilities i…
- CVE-2009-0649The web browser in Symbian OS on the Nokia N95 cell phone al…
- CVE-2009-0650Stack-based buffer overflow in the GetStatsFromLine function…
- CVE-2009-0651Unspecified vulnerability in the Veritas network daemon (aka…
- CVE-2009-0652The Internationalized Domain Names (IDN) blacklist in Mozill…
Are you affected by CVE-2009-0646?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST