CVE-2009-2308 EXPLOIT
7.5
HIGH · CVSS 2.0 · EPSS 1.2% (pctl 67)
Patch early
A public exploit exists.
Description
Multiple SQL injection vulnerabilities in affiliates.php in the Affiliation (aka Affiliates) module 1.1.0 and earlier for PunBB allow remote attackers to execute arbitrary SQL commands via the (1) in or (2) out parameter.
Scoring
| CVSS | 7.5 (HIGH, v2.0) |
|---|---|
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| EPSS | 1.18% — more likely to be exploited than 67% of all CVEs |
| Weakness | CWE-89 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2009-07-02 |
| Last modified | 2026-06-16 |
Affected (2)
| Vendor | Product |
|---|---|
| punbb | punbb |
| punres | affiliates mod |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | PunBB Affiliates Mod 1.1 - Blind SQL Injection | 2009-06-30 |
References
- http://packetstormsecurity.org/0906-exploits/punbbaffiliations-blindsql.txt
- http://packetstormsecurity.org/0906-exploits/punbbaffiliationsin-blindsql.txt
- http://secunia.com/advisories/35654
- http://www.exploit-db.com/exploits/9055
- http://www.osvdb.org/55478
- https://exchange.xforce.ibmcloud.com/vulnerabilities/51437
- http://packetstormsecurity.org/0906-exploits/punbbaffiliations-blindsql.txt
- http://packetstormsecurity.org/0906-exploits/punbbaffiliationsin-blindsql.txt
- http://secunia.com/advisories/35654
- http://www.exploit-db.com/exploits/9055
- http://www.osvdb.org/55478
- https://exchange.xforce.ibmcloud.com/vulnerabilities/51437
→ the Explorer · watch your stack · NVD