CVE-2009-2337: SQL Injection

Published Jul 7, 2009

Updated

SQL injection vulnerability in includes/module/book/index.inc.php in w3b|cms Gaestebuch Guestbook Module 3.0.0, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the spamid parameter.

Affected Software

2 affected components

W3bcms W3bcms

W3bcms Gaestebuch Guestbook Module=3.0.0

Remediation

Patch Available

http://osvdb.org/53614

Event History

Jul 7, 2009

CVE Published

via MITRE·06:35 PM

Data Sourced

via MITRE·06:35 PM

Description

Data Sourced

07:00 PM

DescriptionWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2009-2337?

CVE-2009-2337 is considered a high severity vulnerability due to its potential for remote code execution via SQL injection.

How do I fix CVE-2009-2337?

To fix CVE-2009-2337, upgrade to a version of the Gastebuch Guestbook Module that addresses the SQL injection vulnerability.

What systems are affected by CVE-2009-2337?

CVE-2009-2337 affects the w3b|cms Gaestebuch Guestbook Module version 3.0.0 when magic_quotes_gpc is disabled.

Can CVE-2009-2337 be exploited without authentication?

Yes, CVE-2009-2337 can be exploited by remote attackers without authentication if they can access the affected page.

What inputs trigger the vulnerability in CVE-2009-2337?

The CVE-2009-2337 vulnerability is triggered through manipulation of the spam_id parameter in the affected module.