CVE-2009-0646 Information

Description

Multiple SQL injection vulnerabilities in 4Site CMS 2.6 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) login and (2) password parameters to pcgi/4site.pl (3) page parameter to print/print.shtml (4) s and (5) i parameters to portfolio/index.shtml (6) h parameter to hotel/index.php (7) id parameter to news/news1.shtml and the (8) th parameter to faq/index.shtml.

Reference

http://secunia.com/advisories/33733 http://wsec.ru/wsec-09-002-4site-cms-26-multiple-sql-injections/ http://www.htbridge.ch/advisory/sql_injection_in_4site_cms.html http://www.osvdb.org/51806 http://www.osvdb.org/51807 http://www.osvdb.org/51808 http://www.osvdb.org/51809 http://www.securityfocus.com/archive/1/514376/100/0/threaded http://www.securityfocus.com/bid/33594 https://exchange.xforce.ibmcloud.com/vulnerabilities/48483 https://exchange.xforce.ibmcloud.com/vulnerabilities/48486 https://exchange.xforce.ibmcloud.com/vulnerabilities/48487 https://exchange.xforce.ibmcloud.com/vulnerabilities/48488 https://www.exploit-db.com/exploits/7964