CVE-2009-4238

MediumCVSS 6.5/10Last modified Jun 16, 2026

Description

Multiple SQL injection vulnerabilities in TestLink before 1.8.5 allow remote authenticated users to execute arbitrary SQL commands via (1) the Test Case ID field to lib/general/navBar.php or (2) the logLevel parameter to lib/events/eventviewer.php.

Metrics

CVSS 2.0 6.5/10AV:N/AC:L/Au:S/C:P/I:P/A:P

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://archives.neohapsis.com/archives/fulldisclosure/2009-12/0221.html
http://osvdb.org/60919
http://osvdb.org/60920
http://www.coresecurity.com/content/testlink-multiple-injection-vulnerabilitiesExploit
http://www.securityfocus.com/bid/37258Exploit
http://www.teamst.org/index.php?option=com_content&task=view&id=84&Itemid=2Patch, Vendor Advisory, URL Repurposed
http://archives.neohapsis.com/archives/fulldisclosure/2009-12/0221.html
http://osvdb.org/60919
http://osvdb.org/60920
http://www.coresecurity.com/content/testlink-multiple-injection-vulnerabilitiesExploit
http://www.securityfocus.com/bid/37258Exploit
http://www.teamst.org/index.php?option=com_content&task=view&id=84&Itemid=2Patch, Vendor Advisory, URL Repurposed

Timeline

Published: Dec 10, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2009

CVE-2009-42394.3Cross-site scripting (XSS) vulnerability in the Web console in IBM InfoSphere Information Server 8.1 before FP1 allows remote attackers to i CVE-2009-424010.0Multiple buffer overflows in unspecified setuid executables in the DataStage subsystem in IBM InfoSphere Information Server 8.1 before FP1 h CVE-2009-42419.3Heap-based buffer overflow in RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0 CVE-2009-42429.3Heap-based buffer overflow in the CGIFCodec::GetPacketBuffer function in datatype/image/gif/common/gifcodec.cpp in RealNetworks RealPlayer 1 CVE-2009-42439.3RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac CVE-2009-42449.3Heap-based buffer overflow in RealNetworks RealPlayer 10; RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741; RealPlayer 11 11.0.0 through 11.0 CVE-2009-42459.3Heap-based buffer overflow in RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0 CVE-2009-42469.3Stack-based buffer overflow in RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.CVE-2009-42479.3Stack-based buffer overflow in protocol/rtsp/rtspclnt.cpp in RealNetworks RealPlayer 10; RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741; Re CVE-2009-42489.3Buffer overflow in the RTSPProtocol::HandleSetParameterRequest function in client/core/rtspprotocol.cpp in RealNetworks RealPlayer 10, RealP CVE-2009-42492.6Multiple cross-site scripting (XSS) vulnerabilities in CutePHP CuteNews 1.4.6, when register_globals is enabled and magic_quotes_gpc is disa CVE-2009-42504.3Multiple cross-site scripting (XSS) vulnerabilities in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b allow remote attackers to inject