medium6.5Public exploit code
CVE-2009-1038
Multiple SQL injection vulnerabilities in YAP Blog 1.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) image_id parameter to comments.ph…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- YAP 1.1.1 - Blind SQL Injection / SQL Injection2009-03-16 · webapps · php · Verified
- YAP 1.1.1 - 'index.php' Local File Inclusion2009-03-13 · webapps · php · Verified
Impact
Multiple SQL injection vulnerabilities in YAP Blog 1.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) image_id parameter to comments.php, and remote authenticated administrators to execute arbitrary SQL commands via the (2) user parameter in a modif action to admin/index.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Yap | Yap Blog | Version 1.1.1 |