high7.5Public exploit code
CVE-2009-2307
SQL injection vulnerability in the CWGuestBook module 2.1 and earlier for MAXdev MDPro (aka MD-Pro) allows remote attackers to execute arbitrary SQL commands v…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- MDPro Module CWGuestBook 2.1 - SQL Injection2009-06-30 · webapps · php · Verified
Impact
SQL injection vulnerability in the CWGuestBook module 2.1 and earlier for MAXdev MDPro (aka MD-Pro) allows remote attackers to execute arbitrary SQL commands via the rid parameter in a viewrecords action to modules.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Maxdev | Cwguestbook | through 2.1 |