CVE-2009-3439
OSSIM < 2.1.2 - Authenticated SQL Injection via Multiple Parameters
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2009-3439.
AI-analyzed exploit summary This advisory details multiple SQL injection, XSS, and unauthorized access vulnerabilities in OSSIM 2.1 and 2.1.1, providing specific vulnerable scripts, parameters, and example exploit URLs. It includes technical details on attack vectors but does not contain functional exploit code.
Description
Multiple SQL injection vulnerabilities in Open Source Security Information Management (OSSIM) before 2.1.2 allow remote authenticated users to execute arbitrary SQL commands via the id_document parameter to (1) repository_document.php, (2) repository_links.php, and (3) repository_editdocument.php in repository/; the (4) group parameter to policy/getpolicy.php; the name parameter to (5) host/newhostgroupform.php and (6) net/modifynetform.php; and unspecified other vectors related to the policy menu.
Exploits (1)
This advisory details multiple SQL injection, XSS, and unauthorized access vulnerabilities in OSSIM 2.1 and 2.1.1, providing specific vulnerable scripts, parameters, and example exploit URLs. It includes technical details on attack vectors but does not contain functional exploit code.