VulnerabilityModified

CVE-2009-0394

SQL injection vulnerability in login.php in Pre Lecture Exercises (PLEs) CMS 1.0 beta 4.2 allows remote attackers to execute arbitrary SQL commands via the school parameter.

HIGH 7.5EPSS 0.95%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.95%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

SQL injection vulnerability in login.php in Pre Lecture Exercises (PLEs) CMS 1.0 beta 4.2 allows remote attackers to execute arbitrary SQL commands via the school parameter.

CVSS 2.0: 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS: 0.95% probability · 59th percentile
CISA KEV: Not listed
Weakness: CWE-89
Affected: ple cms/ple cms
Source: cve@mitre.org

References

http://www.securityfocus.com/bid/33524Exploit
https://www.exploit-db.com/exploits/7917
http://www.securityfocus.com/bid/33524Exploit
https://www.exploit-db.com/exploits/7917

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.