CVE-2009-4936

23Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 1.8%

from disclosure to weapon0 days

Published on NVDJul 22

1st PoCMay 29

exploitation probability

1.8%top 23% of all CVEs

observed exploitation

nono source reports it

2 public exploit(s)

Multiple SQL injection vulnerabilities in Small Pirate (SPirate) 2.1 allow remote attackers to execute arbitrary SQL commands via (1) the id parameter to the default URI in an rss .xml action, or the id parameter to (2) pag1.php, (3) pag1-guest.php, (4) rss-comment_post.php (aka rss-coment_post.php), or (5) rss-pic-comment.php.

Affected products

n/a · n/a

public PoCs found — 2✓ VexDay Proof

exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/8819 cve_referencewww.exploit-db.com/exploits/8819unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://osvdb.org/54784 http://osvdb.org/54785 http://osvdb.org/54786 http://osvdb.org/54787 http://osvdb.org/54788 http://secunia.com/advisories/35272 https://exchange.xforce.ibmcloud.com/vulnerabilities/50837 http://www.exploit-db.com/exploits/8819 http://www.securityfocus.com/archive/1/503863/100/0/threaded