CVE-2009-3439: SQL Injection
Multiple SQL injection vulnerabilities in Open Source Security Information Management (OSSIM) before 2.1.2 allow remote authenticated users to execute arbitrary SQL commands via the iddocument parameter to (1) repositorydocument.php, (2) repositorylinks.php, and (3) repositoryeditdocument.php in repository/; the (4) group parameter to policy/getpolicy.php; the name parameter to (5) host/newhostgroupform.php and (6) net/modifynetform.php; and unspecified other vectors related to the policy menu.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2009-3439?
CVE-2009-3439 is classified as a medium severity vulnerability due to the potential for unauthorized SQL command execution.
How do I fix CVE-2009-3439?
To fix CVE-2009-3439, upgrade Open Source Security Information Management (OSSIM) to version 2.1.2 or later.
What systems are affected by CVE-2009-3439?
CVE-2009-3439 affects OSSIM versions before 2.1.2, including 1.0.4, 1.0.6, and 2.1 in both 32-bit and 64-bit configurations.
What kind of attack can be performed through CVE-2009-3439?
CVE-2009-3439 allows remote authenticated users to execute arbitrary SQL commands, which can lead to data leakage or manipulation.
Is authentication required to exploit CVE-2009-3439?
Yes, exploitation of CVE-2009-3439 requires that the attacker is an authenticated user.