CVE-2009-4791

Multiple SQL injection vulnerabilities in Family Connections (aka FCMS) before 1.8.2 allow remote attackers to execute arbitrary SQL commands via the (1) letter parameter to addressbook.php, (2) id parameter to recipes.php, (3) year parameter to register.php, (4) poll_id parameter to home.php, and (5) email parameter to lostpw.php.

CVSS v2.0 NVD

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

1.28% chance of exploitation in the next 30 days, 70th percentile

Published

2010-04-22

Updated

2024-08-07

Proof-of-concept exploits (1)

• http://www.exploit-db.com/exploits/8319

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/8319

Security advisories

• http://secunia.com/advisories/34503
• http://www.securityfocus.com/bid/34297

References

• CVE Record
• NVD entry