CVE-2009-2366

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

SQL injection vulnerability in login.asp in DataCheck Solutions ForumPal FE 1.1 and ForumPal 1.5 allows remote attackers to execute arbitrary SQL commands via the (1) password parameter in 1.1 and (2) p_password parameter in 1.5. NOTE: some of these details are obtained from third party information.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/35589Vendor Advisory
http://secunia.com/advisories/35603Vendor Advisory
http://www.exploit-db.com/exploits/9024
http://www.osvdb.org/55496Exploit
http://www.osvdb.org/55497Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/51403
http://secunia.com/advisories/35589Vendor Advisory
http://secunia.com/advisories/35603Vendor Advisory
http://www.exploit-db.com/exploits/9024
http://www.osvdb.org/55496Exploit
http://www.osvdb.org/55497Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/51403

Timeline

Published: Jul 8, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2009

CVE-2009-23679.8cgi-bin/makecgi-pro in Iomega StorCenter Pro generates predictable session IDs, which allows remote attackers to hijack active sessions and CVE-2009-236810.0Unspecified vulnerability in Socks Server 5 before 3.7.8-8 has unknown impact and attack vectors.CVE-2009-23696.8Integer overflow in the wxImage::Create function in src/common/image.cpp in wxWidgets 2.8.10 allows attackers to cause a denial of service (CVE-2009-23704.3Cross-site scripting (XSS) vulnerability in Advanced Forum 5.x before 5.x-1.1 and 6.x before 6.x-1.1, a module for Drupal, allows remote att CVE-2009-23716.5Advanced Forum 6.x before 6.x-1.1, a module for Drupal, does not prevent users from modifying user signatures after the associated comment f CVE-2009-23726.5Drupal 6.x before 6.13 does not prevent users from modifying user signatures after the associated comment format has been changed to an admi CVE-2009-23734.3Cross-site scripting (XSS) vulnerability in the Forum module in Drupal 6.x before 6.13 allows remote attackers to inject arbitrary web scrip CVE-2009-23744.3Drupal 5.x before 5.19 and 6.x before 6.13 does not properly sanitize failed login attempts for pages that contain a sortable table, which i CVE-2009-23759.3Stack-based buffer overflow in Photo DVD Maker 8.02, and possibly earlier versions, allows remote attackers to execute arbitrary code via a CVE-2009-23764.3Cross-site scripting (XSS) vulnerability in the Html::textarea function in application/libraries/Html.php in TangoCMS 2.x before 2.3.0 allow CVE-2009-23774.3Buffer overflow in the Avax Vector ActiveX control in avPreview.ocx in AVAX-software Avax Vector ActiveX 1.3 allows remote attackers to caus CVE-2009-23787.5PHP remote file inclusion vulnerability in formmailer.admin.inc.php in Jax FormMailer 3.0.0 allows remote attackers to execute arbitrary PHP