CVE

Id
40169  
CVE No.
CVE-2009-2734  
Status
Candidate  
Description
SQL injection vulnerability in the get_employee function in classweekreport.inc in Achievo before 1.4.0 allows remote attackers to execute arbitrary SQL commands via the userid parameter (aka user_id variable) to dispatch.php.  
Phase
Assigned (20090810)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
441700 40169 CVE-2009-2734 BUGTRAQ:20091013 [BONSAI] SQL Injection in Achievo  View
441701 40169 CVE-2009-2734 URL:http://www.securityfocus.com/archive/1/archive/1/507131/100/0/threaded  View
441702 40169 CVE-2009-2734 MISC:http://www.bonsai-sec.com/research/vulnerabilities/achievo-sql-injection-0102.txt  View
441703 40169 CVE-2009-2734 CONFIRM:http://www.achievo.org/download/releasenotes/1_4_0  View
441704 40169 CVE-2009-2734 BID:36660  View
441705 40169 CVE-2009-2734 URL:http://www.securityfocus.com/bid/36660  View
441706 40169 CVE-2009-2734 SECTRACK:1023017  View
441707 40169 CVE-2009-2734 URL:http://securitytracker.com/id?1023017  View
441708 40169 CVE-2009-2734 SECUNIA:37035  View
441709 40169 CVE-2009-2734 URL:http://secunia.com/advisories/37035  View
441710 40169 CVE-2009-2734 XF:achievo-dispatch-sql-injection(53743)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
39967 JVNDB-2009-000053 FreeNAS におけるクロスサイトリクエストフォージェリの脆弱性 FreeNAS には、クロスサイトリクエストフォージェリの脆弱性が存在します。 CVE-2009-2738 40169 7.1 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-000053.html  View