VulnerabilityModified
CVE-2009-4731
SQL injection vulnerability in photos.php in Model Agency Manager PRO (formerly Modeling Agency Content Management Script) allows remote attackers to execute arbitrary SQL commands via the album parameter.
HIGH 7.5EPSS 1.16%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.16%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
SQL injection vulnerability in photos.php in Model Agency Manager PRO (formerly Modeling Agency Content Management Script) allows remote attackers to execute arbitrary SQL commands via the album parameter.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 1.16% probability · 65th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-89
- Affected
- boldfx/model agency manager pro
- Source
- cve@mitre.org
References
- http://packetstormsecurity.org/0907-exploits/articlepubpro-sql.txtExploit
- http://secunia.com/advisories/36066Vendor Advisory
- http://www.securityfocus.com/bid/35892Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/52155
- http://packetstormsecurity.org/0907-exploits/articlepubpro-sql.txtExploit
- http://secunia.com/advisories/36066Vendor Advisory
- http://www.securityfocus.com/bid/35892Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/52155
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.