leidecker.info
http://www.leidecker.info/advisories/2009-05-30-ocs_inventory_ng_sql_injection.shtml CVE-2009-3040
OCS Inventory NG 1.02 - Multiple SQL Injections
Record summary
CVE-2009-3040 has a selected CVSS score of 7.5; EIP currently links 1 catalogued exploit.
Description
Multiple SQL injection vulnerabilities in Open Computer and Software (OCS) Inventory NG 1.02 for Unix allow remote attackers to execute arbitrary SQL commands via the (1) N, (2) DL, (3) O and (4) V parameters to download.php and the (5) SYSTEMID parameter to group_show.php.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
Proofs of concept
1Catalogued exploits
ExploitDBOCS Inventory NG 1.02 - Multiple SQL InjectionsExploitDB exploitby Nico LeideckerNot analyzed1 file
References
5ocsinventory-ng.orgConfirmation
http://www.ocsinventory-ng.org/index.php?mact=News%2Ccntnt01%2Cdetail%2C0&cntnt01articleid=140&cntnt01returnid=72 ocsinventory-ng.org
http://www.ocsinventory-ng.org/index.php?mact=News,cntnt01,detail,0&cntnt01articleid=140&cntnt01returnid=72 20090530 OCS Inventory NG 1.02 - Multiple SQL Injectionsmailing list
http://www.securityfocus.com/archive/1/503936/100/0/threaded nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2009-3040