high7.5Public exploit code
CVE-2009-2428
Multiple SQL injection vulnerabilities in Tausch Ticket Script 3 allow remote attackers to execute arbitrary SQL commands via the (1) userid parameter to sucha…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Tausch Ticket Script 3 - 'vote.php?descr' SQL Injection2009-07-07 · webapps · php · Verified
- Tausch Ticket Script 3 - 'suchauftraege_user.php?userid' SQL Injection2009-07-07 · webapps · php · Verified
Impact
Multiple SQL injection vulnerabilities in Tausch Ticket Script 3 allow remote attackers to execute arbitrary SQL commands via the (1) userid parameter to suchauftraege_user.php and the (2) descr parameter to vote.php; and other unspecified vectors.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Tauschregal.De | Tausch Ticket Script | Version 3 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstorm.linuxsecurity.com/0907-exploits/tausch-sql.txt
- http://secunia.com/advisories/35725
- http://www.vupen.com/english/advisories/2009/1823
- http://packetstorm.linuxsecurity.com/0907-exploits/tausch-sql.txt
- http://secunia.com/advisories/35725
- http://www.vupen.com/english/advisories/2009/1823