high7.5Public exploit code
CVE-2011-0407
SQL injection vulnerability in the store function in _phenotype/system/class/PhenoTypeDataObject.class.php in Phenotype CMS 3.0 allows remote attackers to exec…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Phenotype CMS 3.0 - SQL Injection2011-01-06 · webapps · php
Impact
SQL injection vulnerability in the store function in _phenotype/system/class/PhenoTypeDataObject.class.php in Phenotype CMS 3.0 allows remote attackers to execute arbitrary SQL commands via a crafted URI, as demonstrated by Gallery/gal_id/1/image1,1.html. NOTE: some of these details are obtained from third party information.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Phenotype-Cms | Phenotype Cms | Version 3.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://osvdb.org/70308
- http://secunia.com/advisories/42837
- http://www.htbridge.ch/advisory/sql_injection_in_phenotype_cms.html
- http://www.securityfocus.com/archive/1/515577/100/0/threaded
- http://www.securityfocus.com/bid/45700
- https://exchange.xforce.ibmcloud.com/vulnerabilities/64538
- http://osvdb.org/70308
- http://secunia.com/advisories/42837
- http://www.htbridge.ch/advisory/sql_injection_in_phenotype_cms.html
- http://www.securityfocus.com/archive/1/515577/100/0/threaded
- http://www.securityfocus.com/bid/45700
- https://exchange.xforce.ibmcloud.com/vulnerabilities/64538