PT-2009-3855

CVE-2009-1323

Published

2009-04-17

Updated

2017-09-29

Description by

CVSS 2.0

7.5

High

MetricsAV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Web File Explorer version 3.1

Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands. This is achieved by manipulating the id parameter in the "body.asp" file.

Recommendations For Web File Explorer version 3.1, avoid using the id parameter in the body.asp file until a fix is available. Consider restricting access to the body.asp file to minimize the risk of exploitation.

Exploitability

Exploit

Fix

Impacts

Researchers

Giovanni Buzzin

Osirys

Vendors

Affected products

Weakness enumeration

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')

Related identifiers