CVE-2009-4791 EXPLOIT
7.5
HIGH · CVSS 2.0 · EPSS 1.3% (pctl 69)
Patch early
A public exploit exists.
Description
Multiple SQL injection vulnerabilities in Family Connections (aka FCMS) before 1.8.2 allow remote attackers to execute arbitrary SQL commands via the (1) letter parameter to addressbook.php, (2) id parameter to recipes.php, (3) year parameter to register.php, (4) poll_id parameter to home.php, and (5) email parameter to lostpw.php.
Scoring
| CVSS | 7.5 (HIGH, v2.0) |
|---|---|
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| EPSS | 1.28% — more likely to be exploited than 69% of all CVEs |
| Weakness | CWE-89 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2010-04-22 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| ryan haudenschilt | family connections |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | family connection 1.8.1 - Multiple Vulnerabilities | 2009-03-30 |
References
- http://secunia.com/advisories/34503
- http://sourceforge.net/project/shownotes.php?release_id=672266
- http://sourceforge.net/tracker/?func=detail&aid=2722736&group_id=189733&atid=930513
- http://www.exploit-db.com/exploits/8319
- http://www.familycms.com/blog/2009/03/fcms-182-released/
- http://www.securityfocus.com/archive/1/502272/100/0/threaded
- http://www.securityfocus.com/bid/34297
- http://secunia.com/advisories/34503
- http://sourceforge.net/project/shownotes.php?release_id=672266
- http://sourceforge.net/tracker/?func=detail&aid=2722736&group_id=189733&atid=930513
- http://www.exploit-db.com/exploits/8319
- http://www.familycms.com/blog/2009/03/fcms-182-released/
- http://www.securityfocus.com/archive/1/502272/100/0/threaded
- http://www.securityfocus.com/bid/34297
→ the Explorer · watch your stack · NVD