Description

SQL injection vulnerability in usersettings.php in e107 0.7.15 and earlier, when "Extended User Fields" is enabled and magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the hide parameter, a different vector than CVE-2005-4224 and CVE-2008-5320.

Remediation

References

CVE-2009-1409

Related Vulnerabilities

WordPress Plugin Remove Yoast SEO comments Unspecified Vulnerability (1.0.4)

Oracle Application Server CVE-2009-1009 Vulnerability (CVE-2009-1009)

ownCloud Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2013-2149)

Prototype Improper Privilege Management Vulnerability (CVE-2020-7993)

Django URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2017-7233)

Severity

Medium

Classification

CVE-2009-1409 CWE-138

Tags

Missing Update Known Vulnerabilities