CVE-2009-4698

Qas module - SQL Injection

Title source: llm
STIX 2.1

Description

Multiple SQL injection vulnerabilities in the Qas (aka Quas) module for XOOPS Celepar allow remote attackers to execute arbitrary SQL commands via the codigo parameter to (1) aviso.php and (2) imprimir.php, and the (3) cod_categoria parameter to categoria.php.

Exploits (2)

exploitdb WRITEUP VERIFIED
by Moudi · textwebappsphp
https://www.exploit-db.com/exploits/9261
exploitdb WORKING POC VERIFIED
by s4r4d0 · textwebappsphp
https://www.exploit-db.com/exploits/9249

References (8)

Core 8
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/56593
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/35820
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://www.osvdb.org/56594
Exploit, Third Party Advisory exploit x_refsource_exploit-db
http://www.exploit-db.com/exploits/9261
Exploit, Third Party Advisory exploit x_refsource_exploit-db
http://www.exploit-db.com/exploits/9249
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/56595
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/51985
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/35966

Scores

EPSS 0.0300
EPSS Percentile 86.6%

Details

CWE
CWE-89
Status published
Products (1)
alexandre_amaral/xoops_celepar 1.0.1
Published Mar 15, 2010
Tracked Since Feb 18, 2026