CVE-2010-1865

Multiple SQL injection vulnerabilities in ClanSphere 2009.0.3 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the IP address to the cs_getip function in generate.php in the Captcha module, or (2) the s_email parameter to the cs_sql_select function in the MySQL database driver (mysql.php).

• CWE-89

• http://osvdb.org/64320
• http://osvdb.org/64321
• http://php-security.org/2010/05/03/mops-2010-004-clansphere-captcha-generator-blind-sql-injection-vulnerability/index.htmlExploit
• http://php-security.org/2010/05/03/mops-2010-005-clansphere-mysql-driver-generic-sql-injection-vulnerability/index.htmlExploit
• http://secunia.com/advisories/39685
• http://trac.clansphere.de/csp/changeset/3803/Exploit, Patch
• http://trac.clansphere.de/csp/changeset/3808/Exploit, Patch
• http://www.csphere.eu/index/news/view/id/487/start/0
• http://www.securityfocus.com/bid/39896
• http://www.vupen.com/english/advisories/2010/1066
• https://exchange.xforce.ibmcloud.com/vulnerabilities/58311
• http://osvdb.org/64320
• http://osvdb.org/64321
• http://php-security.org/2010/05/03/mops-2010-004-clansphere-captcha-generator-blind-sql-injection-vulnerability/index.htmlExploit
• http://php-security.org/2010/05/03/mops-2010-005-clansphere-mysql-driver-generic-sql-injection-vulnerability/index.htmlExploit
• http://secunia.com/advisories/39685
• http://trac.clansphere.de/csp/changeset/3803/Exploit, Patch
• http://trac.clansphere.de/csp/changeset/3808/Exploit, Patch
• http://www.csphere.eu/index/news/view/id/487/start/0
• http://www.securityfocus.com/bid/39896
• http://www.vupen.com/english/advisories/2010/1066
• https://exchange.xforce.ibmcloud.com/vulnerabilities/58311

Published

May 7, 2010

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2010-1859SQL injection vulnerability in newpost.php in DeluxeBB 1.3 a…
• CVE-2010-1860The html_entity_decode function in PHP 5.2 through 5.2.13 an…
• CVE-2010-1861The sysvshm extension for PHP 5.2 through 5.2.13 and 5.3 thr…
• CVE-2010-1862The chunk_split function in PHP 5.2 through 5.2.13 and 5.3 t…
• CVE-2010-1863SQL injection vulnerability in the shoutbox module (modules/…
• CVE-2010-1864The addcslashes function in PHP 5.2 through 5.2.13 and 5.3 t…
• CVE-2010-1866The dechunk filter in PHP 5.3 through 5.3.2, when decoding a…9.8
• CVE-2010-1867SQL injection vulnerability in the ArticleAttachment::GetAtt…
• CVE-2010-1868The (1) sqlite_single_query and (2) sqlite_array_query funct…
• CVE-2010-1869Stack-based buffer overflow in the parser function in GhostS…
• CVE-2010-1870The OGNL extensive expression evaluation capability in XWork…
• CVE-2010-1871JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Appl…8.8