Unscored severity · published Oct 22, 2009
CVE-2009-3758
SQL injection vulnerability in login.php in sample code in the XenServer Resource Kit in Citrix XenCenterWeb allows remote attackers to execute arbitrary SQL commands via the…
–
CVSS
1.2%
EPSS
No
On KEV
Description
SQL injection vulnerability in login.php in sample code in the XenServer Resource Kit in Citrix XenCenterWeb allows remote attackers to execute arbitrary SQL commands via the username parameter. NOTE: some of these details are obtained from third party information.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 67% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
XE
Xencenterweb · Citrix
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-3758
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-3758
Exploit
http://securenetwork.it/ricerca/advisory/download/SN-2009-01.txt
securitytracker.com
http://securitytracker.com/id?1022520
www.exploit-db.com
http://www.exploit-db.com/exploits/9106
Exploit
http://www.securityfocus.com/archive/1/504764
Exploit
http://www.securityfocus.com/bid/35592
Vendor Advisory
http://www.vupen.com/english/advisories/2009/1814
More from Xencenterweb
8.8
CVE-2009-3759
Multiple cross-site request forgery (CSRF) vulnerabilities in sample code in the XenServer Resource Kit in Citrix XenCenterWeb allow remote attackers to hijack the authentication…
–
CVE-2009-3760
Static code injection vulnerability in config/writeconfig.php in the sample code in the XenServer Resource Kit in Citrix XenCenterWeb allows remote attackers to inject arbitrary…
–
CVE-2009-3757
Multiple cross-site scripting (XSS) vulnerabilities in sample code in the XenServer Resource Kit in Citrix XenCenterWeb allow remote attackers to inject arbitrary web script or…