vulnwire
6.5med

CVE-2009-20101 exploit

Multiple SQL injection vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 1.9 and earlier allow remote authenticated users to ex…

Published 17 y ago · modified 4 mo ago · JSON

CVSS
6.5
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.9%
percentile 60%
Public exploits
1
Exploit-DB

Multiple SQL injection vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 1.9 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) thread parameter to messageboard.php, (2) member parameter to profile.php, (3) pid parameter to gallery/index.php, and the (4) fcms_login_id cookie parameter.

Exploit prediction (EPSS)

0.90% probability of exploitation in the next 30 days, higher than 60% of all scored CVEs.

Exploits and detections

  • EDB-8671 Family Connections CMS 1.9 - SQL Injection · webapps · 2009-05-13

CVSS scores

Assigned byVersionScoreVector
NVD2.06.5AV:N/AC:L/Au:S/C:P/I:P/A:P

Classification

Weakness
  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command

References

  • secunia.com /advisories/35039 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • securityfocus.com /bid/34935 · vdb-entry, x_refsource_BID, x_transferred
  • exploit-db.com /exploits/8671 · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • securityfocus.com /archive/1/503477/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • vupen.com /english/advisories/2009/1306 · vdb-entry, x_refsource_VUPEN, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.