CVE-2010-1865 Multiple SQL injection vulnerabilities in ClanSphere 2009.0.3 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the IP address to the cs_getip function in generate.php in th...
HighCVSS 7.5
EPSS 1.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple SQL injection vulnerabilities in ClanSphere 2009.0.3 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the IP address to the cs_getip function in generate.php in the Captcha module, or (2) the s_email parameter to the cs_sql_select function in the MySQL database driver (mysql.php).
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| csphere clansphere | <= 2009.0.3 | No fix listed |
| csphere clansphere | = 2007-rc1 | No fix listed |
| csphere clansphere | = 2007-rc2 | No fix listed |
| csphere clansphere | = 2007-rc3 | No fix listed |
| csphere clansphere | = 2007.0 | No fix listed |
| csphere clansphere | = 2007.1 | No fix listed |
| csphere clansphere | = 2007.2 | No fix listed |
| csphere clansphere | = 2007.2.1 | No fix listed |
| csphere clansphere | = 2007.3 | No fix listed |
| csphere clansphere | = 2007.3.1 | No fix listed |
| csphere clansphere | = 2007.4 | No fix listed |
| csphere clansphere | = 2007.4.1 | No fix listed |
| csphere clansphere | = 2007.4.2 | No fix listed |
| csphere clansphere | = 2007.4.3 | No fix listed |
| csphere clansphere | = 2007.4.4 | No fix listed |
| csphere clansphere | = 2008.0 | No fix listed |
| csphere clansphere | = 2008.1 | No fix listed |
| csphere clansphere | = 2008.2 | No fix listed |
| csphere clansphere | = 2008.2.1 | No fix listed |
| csphere clansphere | = 2009.0 | No fix listed |
| csphere clansphere | = 2009.0-rc1 | No fix listed |
| csphere clansphere | = 2009.0-rc2 | No fix listed |
| csphere clansphere | = 2009.0-rc3 | No fix listed |
| csphere clansphere | = 2009.0.1 | No fix listed |
| csphere clansphere | = 2009.0.2 | No fix listed |
References
- 64320 vdb-entry
- 64321 vdb-entry
- php-security.org exploit
- php-security.org exploit
- 39685 third-party-advisory
- trac.clansphere.de exploit patch
- trac.clansphere.de exploit patch
- www.csphere.eu
- 39896 vdb-entry
- ADV-2010-1066 vdb-entry
- clansphere-captcha-sql-injection(58311) vdb-entry