CVE-2009-3703

Published Dec 18, 2009

Last updated 6 years ago

Overview

Description: Multiple SQL injection vulnerabilities in the WP-Forum plugin before 2.4 for WordPress allow remote attackers to execute arbitrary SQL commands via (1) the search_max parameter in a search action to the default URI, related to wpf.class.php; (2) the forum parameter to an unspecified component, related to wpf.class.php; (3) the topic parameter in a viewforum action to the default URI, related to the remove_topic function in wpf.class.php; or the id parameter in a (4) editpost or (5) viewtopic action to the default URI, related to wpf-post.php.
Source: cve@mitre.org
NVD status: Modified

Hype score: Not currently trending

Risk scores

CVSS 2.0

Type: Primary
Base score: 7.5
Impact score: 6.4
Exploitability score: 10
Vector string: AV:N/AC:L/Au:N/C:P/I:P/A:P

Weaknesses

nvd@nist.gov: CWE-89

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:fahlstad:wp-forum:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "1565D880-7E80-41A3-8195-88F3F5D7F72B",
            "versionEndIncluding": "2.2"
          },
          {
            "criteria": "cpe:2.3:a:fahlstad:wp-forum:1.5:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "98445733-1C33-4395-AC1A-4E868D2CCAC7"
          },
          {
            "criteria": "cpe:2.3:a:fahlstad:wp-forum:1.6:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "62E080D2-696D-4544-916E-EB80FBE9F77B"
          },
          {
            "criteria": "cpe:2.3:a:fahlstad:wp-forum:1.7:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "60063708-9783-43B7-A54A-901D14CBD6F5"
          },
          {
            "criteria": "cpe:2.3:a:fahlstad:wp-forum:1.7.3:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F5987635-99C6-4EAD-A6DB-C5587308BA6A"
          },
          {
            "criteria": "cpe:2.3:a:fahlstad:wp-forum:1.7.4:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "24761E14-6295-483D-85D6-6A7FE5DBEDAC"
          },
          {
            "criteria": "cpe:2.3:a:fahlstad:wp-forum:1.7.8:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "93719296-DB05-48C1-A2B5-32828DD169E5"
          },
          {
            "criteria": "cpe:2.3:a:fahlstad:wp-forum:1.8:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "9F51B17F-9582-4B7E-9FB3-F495414D3CC7"
          },
          {
            "criteria": "cpe:2.3:a:fahlstad:wp-forum:2.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "C589E6AD-ECFA-4143-ABD6-DD1204F0E7BA"
          },
          {
            "criteria": "cpe:2.3:a:fahlstad:wp-forum:2.1:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F300AB0F-938B-4EE5-BDB1-3CBF1C290F48"
          }
        ],
        "operator": "OR"
      },
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "847DA578-4655-477E-8A6F-99FBE738E4F9"
          }
        ],
        "operator": "OR"
      }
    ],
    "operator": "AND"
  }
]

Overview

Social media

Risk scores

CVSS 2.0

Weaknesses

Configurations

References