high7.5Public exploit code
CVE-2009-3543
SQL injection vulnerability in _phenotype/admin/login.php in Phenotype CMS before 2.9 allows remote attackers to execute arbitrary SQL commands via the user pa…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Phenotype CMS 2.8 - 'login.php?user' Blind SQL Injection2009-07-10 · webapps · php · Verified
Impact
SQL injection vulnerability in _phenotype/admin/login.php in Phenotype CMS before 2.9 allows remote attackers to execute arbitrary SQL commands via the user parameter (aka the login name).
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Phenotype-Cms | Phenotype Cms | through 2.8 Versions 1.0, 2.0, 2.1, 2.2, 2.3 |
Weakness classification
References
- NVD record
- CVE.org record
- http://secunia.com/advisories/35792
- http://www.exploit-db.com/exploits/9107
- http://www.osvdb.org/55799
- http://www.phenotype-cms.com/wiki/development-changelog
- https://exchange.xforce.ibmcloud.com/vulnerabilities/51634
- http://secunia.com/advisories/35792
- http://www.exploit-db.com/exploits/9107
- http://www.osvdb.org/55799
- http://www.phenotype-cms.com/wiki/development-changelog
- https://exchange.xforce.ibmcloud.com/vulnerabilities/51634