CVE-2010-1365

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

SQL injection vulnerability in index.php in Uiga Fan Club, as downloaded on 20100310, allows remote attackers to execute arbitrary SQL commands via the id parameter in a photos action.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://4004securityproject.wordpress.com/2010/02/28/uigafanclub-index-php-sql-injection/
http://packetstormsecurity.org/1002-exploits/uigafc-sql.txtExploit
http://secunia.com/advisories/38756Vendor Advisory
http://www.exploit-db.com/exploits/11600Exploit
http://www.vupen.com/english/advisories/2010/0487Vendor Advisory
http://4004securityproject.wordpress.com/2010/02/28/uigafanclub-index-php-sql-injection/
http://packetstormsecurity.org/1002-exploits/uigafc-sql.txtExploit
http://secunia.com/advisories/38756Vendor Advisory
http://www.exploit-db.com/exploits/11600Exploit
http://www.vupen.com/english/advisories/2010/0487Vendor Advisory

Timeline

Published: Apr 13, 2010
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2010

CVE-2010-13667.5Multiple SQL injection vulnerabilities in admin/admin_login.php in Uiga Fan Club 1.0 and earlier allow remote attackers to execute arbitrary CVE-2010-13674.3Multiple cross-site scripting (XSS) vulnerabilities in admin/admin_login.php in Uiga Fan Club, as downloaded on 20100310, allow remote attac CVE-2010-13687.5SQL injection vulnerability in index.php in GameScript (GS) 3.0 allows remote attackers to execute arbitrary SQL commands via the id paramet CVE-2010-13697.5SQL injection vulnerability in signup.asp in Pre Classified Listings ASP allows remote attackers to execute arbitrary SQL commands via the e CVE-2010-13707.5SQL injection vulnerability in detailad.asp in Pre Classified Listings ASP allows remote attackers to execute arbitrary SQL commands via the CVE-2010-13714.3Cross-site scripting (XSS) vulnerability in signup.asp in Pre Classified Listings ASP allows remote attackers to inject arbitrary web script CVE-2010-13727.5SQL injection vulnerability in the HD FLV Player (com_hdflvplayer) component 1.3 for Joomla! allows remote attackers to execute arbitrary SQ CVE-2010-13734.3Cross-site scripting (XSS) vulnerability in Help Viewer in Apple Mac OS X 10.6 before 10.6.4 allows remote attackers to inject arbitrary web CVE-2010-13744.3Directory traversal vulnerability in iChat in Apple Mac OS X 10.5.8, and 10.6 before 10.6.4, when AIM is used, allows remote attackers to cr CVE-2010-13757.2NetAuthSysAgent in Network Authorization in Apple Mac OS X 10.5.8 does not have the expected authorization requirements, which allows local CVE-2010-13766.8Multiple format string vulnerabilities in Network Authorization in Apple Mac OS X 10.6 before 10.6.4 allow remote attackers to execute arbit CVE-2010-13779.3Open Directory in Apple Mac OS X 10.6 before 10.6.4 creates an unencrypted connection upon certain SSL failures, which allows man-in-the-mid