CVE-2009-2004

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Multiple SQL injection vulnerabilities in main/mySpace/myStudents.php in Dokeos 1.8.5, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the (1) student and (2) course parameters, a different vector than CVE-2007-2902.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://holisticinfosec.org/content/view/112/45/
http://secunia.com/advisories/34879Vendor Advisory
http://www.dokeos.com/wiki/index.php/Security#Dokeos_1.8Patch, Vendor Advisory
http://www.securityfocus.com/bid/34928
http://www.vupen.com/english/advisories/2009/1300Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/50501
http://holisticinfosec.org/content/view/112/45/
http://secunia.com/advisories/34879Vendor Advisory
http://www.dokeos.com/wiki/index.php/Security#Dokeos_1.8Patch, Vendor Advisory
http://www.securityfocus.com/bid/34928
http://www.vupen.com/english/advisories/2009/1300Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/50501

Timeline

Published: Jun 8, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2009

CVE-2009-20056.8Cross-site request forgery (CSRF) vulnerability in Dokeos 1.8.5, and possibly earlier, allows remote attackers to hijack the authentication CVE-2009-20062.6Multiple cross-site scripting (XSS) vulnerabilities in Dokeos 1.8.5, and possibly earlier, allow remote attackers to inject arbitrary web sc CVE-2009-20075.0Multiple directory traversal vulnerabilities in Dokeos 1.8.5, and possibly earlier, allow remote attackers to (1) read portions of arbitrary CVE-2009-20086.8Multiple SQL injection vulnerabilities in Dokeos 1.8.5, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via t CVE-2009-20094.3Multiple cross-site scripting (XSS) vulnerabilities in Dokeos 1.8.5, and possibly earlier, allow remote attackers to inject arbitrary web sc CVE-2009-20106.5Multiple SQL injection vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 1.9 and earlier allow remote authenticated users to exe CVE-2009-20119.3Worldweaver DX Studio Player 3.0.29.0, 3.0.22.0, 3.0.12.0, and probably other versions before 3.0.29.1, when used as a plug-in for Firefox, CVE-2009-20121.9Unspecified vulnerability in idmap in Sun OpenSolaris snv_88 through snv_110, when a CIFS server is enabled, allows local users to cause a d CVE-2009-20137.5SQL injection vulnerability in bin/aps_browse_sources.php in Frontis 3.9.01.24 allows remote attackers to execute arbitrary SQL commands via CVE-2009-20147.5SQL injection vulnerability in the ComSchool (com_school) component 1.4 for Joomla! allows remote attackers to execute arbitrary SQL command CVE-2009-20157.5Directory traversal vulnerability in includes/file_includer.php in the Ideal MooFAQ (com_moofaq) component 1.0 for Joomla! allows remote att CVE-2009-20167.5SQL injection vulnerability in products.php in Virtue Shopping Mall allows remote attackers to execute arbitrary SQL commands via the cid pa