CVE-2009-2345

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Multiple SQL injection vulnerabilities in ClanSphere before 2009.0.1 allow remote attackers to execute arbitrary SQL commands via unknown parameters to the gbook module and unspecified other components.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/35694Vendor Advisory
http://www.clansphere.net/index/news/view/id/405/
http://www.securityfocus.com/bid/35576Patch
http://www.vupen.com/english/advisories/2009/1794Patch, Vendor Advisory
http://secunia.com/advisories/35694Vendor Advisory
http://www.clansphere.net/index/news/view/id/405/
http://www.securityfocus.com/bid/35576Patch
http://www.vupen.com/english/advisories/2009/1794Patch, Vendor Advisory

Timeline

Published: Jul 7, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2009

CVE-2009-23467.8The IAX2 protocol implementation in Asterisk Open Source 1.2.x before 1.2.35, 1.4.x before 1.4.26.2, 1.6.0.x before 1.6.0.15, and 1.6.1.x be CVE-2009-23479.3Multiple integer overflows in inter-color spaces conversion tools in libtiff 3.8 through 3.8.2, 3.9, and 4.0 allow context-dependent attacke CVE-2009-23486.9Android 1.5 CRBxx allows local users to bypass the (1) Manifest.permission.CAMERA (aka android.permission.CAMERA) and (2) Manifest.permissio CVE-2009-23504.3Microsoft Internet Explorer 6.0.2900.2180 and earlier does not block javascript: URIs in Refresh headers in HTTP responses, which allows rem CVE-2009-23514.3Opera 9.52 and earlier does not block javascript: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-CVE-2009-23524.3Google Chrome 1.0.154.48 and earlier does not block javascript: URIs in Refresh headers in HTTP responses, which allows remote attackers to CVE-2009-23536.8encoder.php in eAccelerator allows remote attackers to execute arbitrary code by copying a local executable file to a location under the web CVE-2009-23547.5SQL injection vulnerability in the auth_checkpass function in the login page in NullLogic Groupware 1.2.7 allows remote attackers to execute CVE-2009-23554.0The forum module in NullLogic Groupware 1.2.7 allows remote authenticated users to cause a denial of service (application crash) by specifyi CVE-2009-23569.3Multiple stack-based buffer overflows in the pgsqlQuery function in NullLogic Groupware 1.2.7, when PostgreSQL is used, might allow remote a CVE-2009-235710.0The default configuration of TekRADIUS 3.0 uses the sa account to communicate with Microsoft SQL Server, which makes it easier for remote at CVE-2009-23584.6TekRADIUS 3.0 uses BUILTIN\Users:R permissions for the TekRADIUS.ini file, which allows local users to obtain obfuscated database credential