CVE-2009-2308

23Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 1.2%

from disclosure to weapon0 days

Published on NVDJul 2

1st PoCJun 30

exploitation probability

1.2%top 35% of all CVEs

observed exploitation

nono source reports it

4 public exploit(s)

Multiple SQL injection vulnerabilities in affiliates.php in the Affiliation (aka Affiliates) module 1.1.0 and earlier for PunBB allow remote attackers to execute arbitrary SQL commands via the (1) in or (2) out parameter.

Affected products

n/a · n/a

public PoCs found — 4✓ VexDay Proof

exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/9055 cve_referencewww.exploit-db.com/exploits/9055unverified cve_referencepacketstormsecurity.org/0906-exploits/punbbaffiliations-blindsql.txtunverified cve_referencepacketstormsecurity.org/0906-exploits/punbbaffiliationsin-blindsql.txtunverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://packetstormsecurity.org/0906-exploits/punbbaffiliations-blindsql.txt http://packetstormsecurity.org/0906-exploits/punbbaffiliationsin-blindsql.txt http://secunia.com/advisories/35654 https://exchange.xforce.ibmcloud.com/vulnerabilities/51437 http://www.exploit-db.com/exploits/9055 http://www.osvdb.org/55478