CVE-2009-1433

SilverStripe < 2.3.1 - SQL Injection via File::find Filename Parameter

Title source: llm
STIX 2.1

Description

SQL injection vulnerability in File::find (filesystem/File.php) in SilverStripe before 2.3.1 allows remote attackers to execute arbitrary SQL commands via the filename parameter.

References (5)

Core 5
Core References
Patch x_refsource_confirm
http://open.silverstripe.com/ticket/3721
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/34485
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/34633
Third Party Advisory x_refsource_confirm
http://open.silverstripe.com/wiki/ChangeLog/2.3.1
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/53589

Scores

EPSS 0.0110
EPSS Percentile 62.1%

Details

CWE
CWE-89
Status published
Products (12)
silverstripe/silverstripe 2.0.0
silverstripe/silverstripe 2.0.1
silverstripe/silverstripe 2.0.2
silverstripe/silverstripe 2.1.0
silverstripe/silverstripe 2.1.1
silverstripe/silverstripe 2.2.0
silverstripe/silverstripe 2.2.1
silverstripe/silverstripe 2.2.2
silverstripe/silverstripe 2.2.4
silverstripe/silverstripe 2.3.0 (4 CPE variants)
... and 2 more
Published Apr 24, 2009
Tracked Since Feb 18, 2026