Unscored severity · published May 20, 2009
CVE-2009-1742
code.php in PC4Arb Pc4 Uploader 9.0 and earlier makes it easier for remote attackers to conduct SQL injection attacks via crafted keyword sequences that are removed from a filter…
–
CVSS
1.3%
EPSS
No
On KEV
Description
code.php in PC4Arb Pc4 Uploader 9.0 and earlier makes it easier for remote attackers to conduct SQL injection attacks via crafted keyword sequences that are removed from a filter in the id parameter in a banner action, as demonstrated via the "UNIunionON" string, which is collapsed into "UNION" by the filter_sql function.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PU
Pc4 Uploader · Pc4arb
through 9.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-1742
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-1742
Exploit
http://osvdb.org/54572
Vendor Advisory
http://secunia.com/advisories/35122
www.securityfocus.com
http://www.securityfocus.com/bid/35004
Vendor Advisory
http://www.vupen.com/english/advisories/2009/1364
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/50586
www.exploit-db.com
https://www.exploit-db.com/exploits/8709
More from Pc4 Uploader
–
CVE-2009-2180
Multiple directory traversal vulnerabilities in upfiles/index.php in Pc4 Uploader 10.0 and earlier allow remote attackers to read arbitrary files via (1) a