CVE-2009-0646

Published: Feb 18, 2009Modified: Apr 23, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

Multiple SQL injection vulnerabilities in 4Site CMS 2.6 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) login and (2) password parameters to pcgi/4site.pl, (3) page parameter to print/print.shtml, (4) s and (5) i parameters to portfolio/index.shtml, (6) h parameter to hotel/index.php, (7) id parameter to news/news1.shtml, and the (8) th parameter to faq/index.shtml.

Affected (1)

Products: 4site: 4site Cms

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
4site 4site Cms	Up to 2.6

Related CWEs

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

References (28)

http://secunia.com/advisories/33733

Source: cve@mitre.org

Vendor Advisory

http://wsec.ru/wsec-09-002-4site-cms-26-multiple-sql-injections/

Source: cve@mitre.org

http://www.htbridge.ch/advisory/sql_injection_in_4site_cms.html

Source: cve@mitre.org

http://www.osvdb.org/51806

Source: cve@mitre.org

http://www.osvdb.org/51807

Source: cve@mitre.org

http://www.osvdb.org/51808

Source: cve@mitre.org

http://www.osvdb.org/51809

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/514376/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/33594

Source: cve@mitre.org

Exploit

https://exchange.xforce.ibmcloud.com/vulnerabilities/48483

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/48486

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/48487

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/48488

Source: cve@mitre.org

https://www.exploit-db.com/exploits/7964

Source: cve@mitre.org

http://secunia.com/advisories/33733

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://wsec.ru/wsec-09-002-4site-cms-26-multiple-sql-injections/

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.htbridge.ch/advisory/sql_injection_in_4site_cms.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.osvdb.org/51806

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.osvdb.org/51807

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.osvdb.org/51808

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.osvdb.org/51809

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/514376/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/33594

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

https://exchange.xforce.ibmcloud.com/vulnerabilities/48483

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/48486

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/48487

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/48488

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.exploit-db.com/exploits/7964

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.