CVE-2009-2023: SQL Injection

Published Jun 9, 2009

Updated

SQL injection vulnerability in index.php in Shop-Script Pro 2.12, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the currentcurrency parameter.

Affected Software

1 affected component

Shop-Script Shop-Script=2.12

Event History

Jun 9, 2009

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Frequently Asked Questions

Which deployments are exposed to this issue?

Shop-Script Pro 2.12 deployments are affected when PHP's magic_quotes_gpc setting is disabled. The issue is reachable through index.php via the current_currency parameter.

Does an attacker need an account or local access?

No. The vulnerability is remotely exploitable and requires no authentication.

What access could successful exploitation provide?

A remote attacker can execute arbitrary SQL commands. The reported impact includes potential compromise of confidentiality, integrity, and availability.

CVE-2009-2023: SQL Injection

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

Does an attacker need an account or local access?

What access could successful exploitation provide?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

Does an attacker need an account or local access?

What access could successful exploitation provide?