Unscored severity · published Sep 18, 2009
CVE-2009-3255
SQL injection vulnerability in RASH Quote Management System (RQMS) 1.2.2 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands…
–
CVSS
1.1%
EPSS
No
On KEV
Description
SQL injection vulnerability in RASH Quote Management System (RQMS) 1.2.2 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the user parameter in an admin action to the default URI.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RA
Rash · Thomas Cuchta
through 1.2.2; 1.0; 1.1; 1.1.1; 1.1.2; 1.1.3; +2 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-3255
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-3255
osvdb.org
http://osvdb.org/57468
Exploit
http://packetstormsecurity.org/0908-exploits/rqms-bypass.txt
Vendor Advisory
http://secunia.com/advisories/36477
Vendor Advisory
http://www.vupen.com/english/advisories/2009/2446
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/52895
More from Rash
–
CVE-2009-3259
Multiple SQL injection vulnerabilities in RASH Quote Management System (RQMS) 1.2.2 allow remote attackers to execute arbitrary SQL commands via (1) the search parameter in a…