CVE-2009-4045 Multiple SQL injection vulnerabilities in FrontAccounting (FA) before 2.1.7 allow remote attackers to execute arbitrary SQL commands via unspecified parameters to various .inc and .php files in (1) re...
HighCVSS 7.5
EPSS 1.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple SQL injection vulnerabilities in FrontAccounting (FA) before 2.1.7 allow remote attackers to execute arbitrary SQL commands via unspecified parameters to various .inc and .php files in (1) reporting/, (2) sales/, (3) sales/includes/, (4) sales/includes/db/, (5) sales/inquiry/, (6) sales/manage/, (7) sales/view/, (8) taxes/, and (9) taxes/db/.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| frontaccounting | <= 2.1.6 | No fix listed |
| frontaccounting | = 2.0 | No fix listed |
| frontaccounting | = 2.0.1 | No fix listed |
| frontaccounting | = 2.0.2 | No fix listed |
| frontaccounting | = 2.0.3 | No fix listed |
| frontaccounting | = 2.0.4 | No fix listed |
| frontaccounting | = 2.0.5 | No fix listed |
| frontaccounting | = 2.0.6 | No fix listed |
| frontaccounting | = 2.0.7 | No fix listed |
| frontaccounting | = 2.1 | No fix listed |
| frontaccounting | = 2.1.0-beta | No fix listed |
| frontaccounting | = 2.1.0-beta_2 | No fix listed |
| frontaccounting | = 2.1.0-rc | No fix listed |
| frontaccounting | = 2.1.1 | No fix listed |
| frontaccounting | = 2.1.2 | No fix listed |
| frontaccounting | = 2.1.3 | No fix listed |
| frontaccounting | = 2.1.4 | No fix listed |
| frontaccounting | = 2.1.5 | No fix listed |
References
- frontaccounting.net patch
- 37327 third-party-advisory vendor-advisory
- sourceforge.net patch
- ADV-2009-3223 vdb-entry vendor-advisory