Unscored severity · published Sep 25, 2009
CVE-2009-3419
SQL injection vulnerability in index.php in the Publisher module 2.0 for Miniweb allows remote attackers to execute arbitrary SQL commands via the historymonth parameter
–
CVSS
0.9%
EPSS
No
On KEV
Description
SQL injection vulnerability in index.php in the Publisher module 2.0 for Miniweb allows remote attackers to execute arbitrary SQL commands via the historymonth parameter.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MI
Miniweb · Intesync
2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-3419
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-3419
www.exploit-db.com
http://www.exploit-db.com/exploits/9338
Exploit
http://www.securityfocus.com/bid/35869
More from Miniweb
–
CVE-2009-4552
Cross-site scripting (XSS) vulnerability in the Survey Pro module for Miniweb 2.0 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php
–
CVE-2009-4551
SQL injection vulnerability in the Survey Pro module for Miniweb 2.0 allows remote attackers to execute arbitrary SQL commands via the campaign_id parameter in a results action to…
–
CVE-2009-3420
Multiple cross-site scripting (XSS) vulnerabilities in index.php in the Publisher module 2.0 for Miniweb allow remote attackers to inject arbitrary web script or HTML via the (1)…