CVE-2009-3042: SQL Injection

Published Sep 1, 2009

Updated

SQL injection vulnerability in machine.php in Open Computer and Software (OCS) Inventory NG 1.02.1 allows remote attackers to execute arbitrary SQL commands via the systemid parameter, a different vector than CVE-2009-3040.

Affected Software

1 affected component

Ocsinventory-ng Ocs Inventory Ng=1.02.1

Remediation

Patch Available

http://www.ocsinventory-ng.org/index.php?mact=News,cntnt01,detail,0&cntnt01articleid=147&cntnt01returnid=15

Event History

Sep 1, 2009

CVE Published

via MITRE·06:04 PM

Data Sourced

via MITRE·06:04 PM

Description

Frequently Asked Questions

What is the severity of CVE-2009-3042?

CVE-2009-3042 has a medium severity rating due to its potential to allow unauthorized SQL command execution.

How do I fix CVE-2009-3042?

To fix CVE-2009-3042, update to a patched version of OCS Inventory NG that resolves the SQL injection vulnerability.

What systems are affected by CVE-2009-3042?

CVE-2009-3042 specifically affects OCS Inventory NG version 1.02.1.

Can CVE-2009-3042 lead to data breaches?

Yes, CVE-2009-3042 can potentially lead to data breaches by allowing attackers to execute arbitrary SQL queries.

Is CVE-2009-3042 still a risk for current software?

While CVE-2009-3042 is an older vulnerability, any systems still running the affected version remain at risk if not updated.