CVE-2009-4437

Multiple SQL injection vulnerabilities in Active Auction House 3.6 allow remote attackers to execute arbitrary SQL commands via the (1) catid parameter to wishlist.asp and the (2) linkid parameter to links.asp. NOTE: vector 1 might overlap CVE-2005-1029.1.

CVSS v2.0 NVD

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

1.02% chance of exploitation in the next 30 days, 63rd percentile

Published

2009-12-28

Updated

2024-08-07

Proof-of-concept exploits (1)

• http://www.exploit-db.com/exploits/10520

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/10520

Security advisories

• http://secunia.com/advisories/14839
• http://www.securityfocus.com/bid/37401

References

• CVE Record
• NVD entry