CVE-2009-4037

Multiple SQL injection vulnerabilities in FrontAccounting (FA) before 2.1.7, and 2.2.x before 2.2 RC, allow remote attackers to execute arbitrary SQL commands via unspecified parameters to (1) admin/db/users_db.inc, and various other .inc and .php files under (2) admin/, (3) dimensions/, (4) gl/, (5) inventory/, (6) manufacturing/, and (7) purchasing/.

Published: Nov 20, 2009
Updated: Apr 13, 2023
CVE: CVE-2009-4037
Severity: High
Exploit:

CVSS v2:

Severity: High
Score: 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P

CWEs:

CWE-89

OWASP TOP 10:

A1 - Injection

Affected Software
References

Software	From	Fixed in
frontaccounting / frontaccounting	2.0.3	2.0.3.x
frontaccounting / frontaccounting	2.1.3	2.1.3.x
frontaccounting / frontaccounting	2.0.7	2.0.7.x
frontaccounting / frontaccounting	2.1.0-rc	2.1.0-rc.x
frontaccounting / frontaccounting	2.0.4	2.0.4.x
frontaccounting / frontaccounting	2.0.2	2.0.2.x
frontaccounting / frontaccounting	2.0.6	2.0.6.x
frontaccounting / frontaccounting	2.1.2	2.1.2.x
frontaccounting / frontaccounting	2.0	2.0.x
frontaccounting / frontaccounting	2.0.5	2.0.5.x
frontaccounting / frontaccounting	2.1.4	2.1.4.x
frontaccounting / frontaccounting	2.1.0-beta_2	2.1.0-beta_2.x
frontaccounting / frontaccounting	2.2-beta	2.2-beta.x
frontaccounting / frontaccounting	2.1.0-beta	2.1.0-beta.x
frontaccounting / frontaccounting	2.1	2.1.x
frontaccounting / frontaccounting	2.1.1	2.1.1.x
frontaccounting / frontaccounting	2.1.5	2.1.5.x
frontaccounting / frontaccounting	2.0.1	2.0.1.x
frontaccounting / frontaccounting	-	2.1.6.x

Vulnerability Database

CVE-2009-4037