CVE-2009-3528 SQL injection vulnerability in Profile.php in MyMsg 1.0.3 allows remote authenticated users to execute arbitrary SQL commands via the uid parameter in a show action.
MediumCVSS 6.5
EPSS 0.86%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
SQL injection vulnerability in Profile.php in MyMsg 1.0.3 allows remote authenticated users to execute arbitrary SQL commands via the uid parameter in a show action.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| al4us mymsg | = 1.0.3 | No fix listed |
References
- 35753 third-party-advisory vendor-advisory
- 9105 exploit
- 55792 exploit vdb-entry
- mymsg-profile-sql-injection(51635) vdb-entry