CVE-2009-4698

Qas module - SQL Injection

Title source: llm

Description

Multiple SQL injection vulnerabilities in the Qas (aka Quas) module for XOOPS Celepar allow remote attackers to execute arbitrary SQL commands via the codigo parameter to (1) aviso.php and (2) imprimir.php, and the (3) cod_categoria parameter to categoria.php.

Exploits (2)

exploitdb WORKING POC VERIFIED

by s4r4d0 · textwebappsphp

https://www.exploit-db.com/exploits/9249

View Code ZIP pw:eip

exploitdb WRITEUP VERIFIED

by Moudi · textwebappsphp

https://www.exploit-db.com/exploits/9261

View Code ZIP pw:eip

References (8)

[Vendor Advisory] http://secunia.com/advisories/35966

[Exploit] http://www.securityfocus.com/bid/35820

[Exploit, Third Party Advisory] http://www.exploit-db.com/exploits/9249

[Exploit, Third Party Advisory] http://www.exploit-db.com/exploits/9261

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/51985

[Third Party Advisory, VDB Entry] http://osvdb.org/56593

[Third Party Advisory, VDB Entry] http://osvdb.org/56595

[Third Party Advisory, VDB Entry] http://www.osvdb.org/56594

Scores

EPSS 0.0300

EPSS Percentile 86.4%

Classification

CWE

CWE-89

Status draft

Affected Products (1)

alexandre_amaral/xoops_celepar

Timeline

Published Mar 15, 2010

Tracked Since Feb 18, 2026