CVE-2009-2113 Multiple SQL injection vulnerabilities in FretsWeb 1.2 allow remote attackers to execute arbitrary SQL commands via the (1) name parameter to player.php and the (2) hash parameter to song.php.
HighCVSS 7.5
EPSS 2.6%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple SQL injection vulnerabilities in FretsWeb 1.2 allow remote attackers to execute arbitrary SQL commands via the (1) name parameter to player.php and the (2) hash parameter to song.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fretsweb project fretsweb | = 1.2 | No fix listed |
References
- 55167 broken-link vdb-entry
- 55168 broken-link vdb-entry
- 35492 third-party-advisory vendor-advisory
- sourceforge.net patch
- 8980 exploit third-party-advisory vdb-entry