CVE-2009-4060: SQL Injection
Published Nov 24, 2009
·Updated
SQL injection vulnerability in includes/content/viewProd.inc.php in CubeCart before 4.3.7 remote attackers to execute arbitrary SQL commands via the productId parameter.
Affected Software
43 affected components
Cubecart CubeCart=4.0.1
Cubecart CubeCart=4.0.0-beta_2
Cubecart CubeCart=3.0.9
Cubecart CubeCart=3.0.8
Cubecart CubeCart=3.0.18
Cubecart CubeCart=3.0.5
Cubecart CubeCart=4.3.4
Cubecart CubeCart=4.0.0
Cubecart CubeCart=3.0.14
Cubecart CubeCart=3.0.13
Cubecart CubeCart=4.1.1
Cubecart CubeCart=4.0.3
Cubecart CubeCart=3.0.16
Cubecart CubeCart=3.0.7
Cubecart CubeCart=3.0.19
Cubecart CubeCart=4.3.5
Cubecart CubeCart=4.3.2
Cubecart CubeCart=3.0.20
Cubecart CubeCart<=4.3.6
Cubecart CubeCart=4.3.1
Cubecart CubeCart=4.2.1
Cubecart CubeCart=3.0.0
Cubecart CubeCart=3.0.3
Cubecart CubeCart=4.1.0
Cubecart CubeCart=3.0.10
Cubecart CubeCart=4.1.0-rc_1
Cubecart CubeCart=3.0.11
Cubecart CubeCart=3.0.2
Cubecart CubeCart=3.0.12
Cubecart CubeCart=4.2.2
Cubecart CubeCart=4.0.0-beta_3
Cubecart CubeCart=4.0.0-rc_1
Cubecart CubeCart=4.2.0
Cubecart CubeCart=4.0.2
Cubecart CubeCart=4.1.0-rc_2
Cubecart CubeCart=3.0.17
Cubecart CubeCart=4.2.3
Cubecart CubeCart=3.0.15
Cubecart CubeCart=3.0.6
Cubecart CubeCart=3.0.4
Cubecart CubeCart=4.3.0
Cubecart CubeCart=3.0.1
Cubecart CubeCart=4.3.3
Event History
Nov 24, 2009
CVE Published
via MITRE·02:00 AM
Data Sourced
via MITRE·02:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2009-4060?
CVE-2009-4060 is classified as a high-severity vulnerability due to the potential for remote SQL injection.
2
How do I fix CVE-2009-4060?
To fix CVE-2009-4060, update your CubeCart installation to version 4.3.7 or later.
3
What versions of CubeCart are affected by CVE-2009-4060?
CVE-2009-4060 affects CubeCart versions prior to 4.3.7, including versions 3.x and 4.x.
4
What types of attacks can be executed due to CVE-2009-4060?
CVE-2009-4060 allows attackers to execute arbitrary SQL commands, potentially compromising the database.
5
Is CVE-2009-4060 being actively exploited?
While CVE-2009-4060 was discovered in 2009, vulnerabilities of this nature can still be exploited if systems remain unpatched.