CVE

Id
39177  
CVE No.
CVE-2009-1742  
Status
Candidate  
Description
code.php in PC4Arb Pc4 Uploader 9.0 and earlier makes it easier for remote attackers to conduct SQL injection attacks via crafted keyword sequences that are removed from a filter in the id parameter in a banner action, as demonstrated via the "UNIunionON" string, which is collapsed into "UNION" by the filter_sql function.  
Phase
Assigned (20090520)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
430851 39177 CVE-2009-1742 MILW0RM:8709  View
430852 39177 CVE-2009-1742 URL:http://www.milw0rm.com/exploits/8709  View
430853 39177 CVE-2009-1742 BID:35004  View
430854 39177 CVE-2009-1742 URL:http://www.securityfocus.com/bid/35004  View
430855 39177 CVE-2009-1742 OSVDB:54572  View
430856 39177 CVE-2009-1742 URL:http://osvdb.org/54572  View
430857 39177 CVE-2009-1742 SECUNIA:35122  View
430858 39177 CVE-2009-1742 URL:http://secunia.com/advisories/35122  View
430859 39177 CVE-2009-1742 VUPEN:ADV-2009-1364  View
430860 39177 CVE-2009-1742 URL:http://www.vupen.com/english/advisories/2009/1364  View
430861 39177 CVE-2009-1742 XF:pc4uploader-code-sql-injection(50586)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
42428 JVNDB-2009-003435 Dian Gemilang DGNews の berita.php における SQL インジェクションの脆弱性 Dian Gemilang DGNews の berita.php には、SQL インジェクションの脆弱性が存在します。 CVE-2009-1746 39177 7.5 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-003435.html  View