VulnerabilityModified

CVE-2009-3190

Multiple SQL injection vulnerabilities in PAD Site Scripts 3.6 allow remote attackers to execute arbitrary SQL commands via the (1) search parameter to list.php and (2) cat parameter to rss.php.

HIGH 7.5EPSS 0.93%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.93%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Multiple SQL injection vulnerabilities in PAD Site Scripts 3.6 allow remote attackers to execute arbitrary SQL commands via the (1) search parameter to list.php and (2) cat parameter to rss.php.

CVSS 2.0: 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS: 0.93% probability · 59th percentile
CISA KEV: Not listed
Weakness: CWE-89
Affected: pad-site-scripts/pad site scripts
Source: cve@mitre.org

References

http://www.exploit-db.com/exploits/9531
http://www.vupen.com/english/advisories/2009/2434Vendor Advisory
http://www.exploit-db.com/exploits/9531
http://www.vupen.com/english/advisories/2009/2434Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.