VulnerabilityModified

CVE-2009-2276

SQL injection vulnerability in voteforus.php in the Vote For Us extension 1.0.1 and earlier for PunBB allows remote attackers to execute arbitrary SQL commands via the out parameter.

HIGH 7.5EPSS 0.92%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.92%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

SQL injection vulnerability in voteforus.php in the Vote For Us extension 1.0.1 and earlier for PunBB allows remote attackers to execute arbitrary SQL commands via the out parameter.

CVSS 2.0: 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS: 0.92% probability · 58th percentile
CISA KEV: Not listed
Weakness: CWE-89
Affected: biglle/vote for us extension
Source: cve@mitre.org

References

http://www.exploit-db.com/exploits/9058
http://www.exploit-db.com/exploits/9058

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.