CVE-2009-4597 Multiple SQL injection vulnerabilities in index.php in PHP Inventory 1.2 allow (1) remote authenticated users to execute arbitrary SQL commands via the user_id parameter in a users details action, and...
HighCVSS 7.5
EPSS 0.99%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple SQL injection vulnerabilities in index.php in PHP Inventory 1.2 allow (1) remote authenticated users to execute arbitrary SQL commands via the user_id parameter in a users details action, and allow remote attackers to execute arbitrary SQL commands via the (2) user (username) and (3) pass (password) parameters. NOTE: some of these details are obtained from third party information.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| phpwares php inventory | = 1.2 | No fix listed |
References
- packetstormsecurity.org exploit
- 37672 third-party-advisory vendor-advisory
- 10370 exploit
- phpinventory-index-sql-injection(54666) vdb-entry