{ "id": "CVE-2009-2579", "sourceIdentifier": "cve@mitre.org", "published": "2009-08-05T19:30:01.017", "lastModified": "2024-11-21T01:05:12.930", "vulnStatus": "Modified", "cveTags": [], "descriptions": [ { "lang": "en", "value": "SQL injection vulnerability in reward_points.post.php in the Reward points addon in CS-Cart before 2.0.6 allows remote authenticated users to execute arbitrary SQL commands via the sort_order parameter in a reward_points.userlog action to index.php, a different vulnerability than CVE-2005-4429.2." }, { "lang": "es", "value": "Vulnerabilidad de inyecci\u00f3n SQL en reward_points.post.php en el complemento Reward points de CS-Cart anterior v2.0.6, permite a usuarios autentificados remotamente ejecutar comandos SQL a su elecci\u00f3n a trav\u00e9s del par\u00e1metro sort_orde en la acci\u00f3n reward_points.userlog en index.php, vulnerabilidad diferente a CVE-2005-4429.2." } ], "metrics": { "cvssMetricV2": [ { "source": "nvd@nist.gov", "type": "Primary", "cvssData": { "version": "2.0", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "baseScore": 6.5, "accessVector": "NETWORK", "accessComplexity": "LOW", "authentication": "SINGLE", "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "availabilityImpact": "PARTIAL" }, "baseSeverity": "MEDIUM", "exploitabilityScore": 8.0, "impactScore": 6.4, "acInsufInfo": false, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false } ] }, "weaknesses": [ { "source": "nvd@nist.gov", "type": "Primary", "description": [ { "lang": "en", "value": "CWE-89" } ] } ], "configurations": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:cs-cart:cs-cart:*:*:*:*:*:*:*:*", "versionEndIncluding": "2.0.5", "matchCriteriaId": "772E5AD9-A801-48B7-94AD-D2C0007775A9" }, { "vulnerable": true, "criteria": "cpe:2.3:a:cs-cart:cs-cart:1.1:*:*:*:*:*:*:*", "matchCriteriaId": "A21449C4-0D1F-4642-9193-19E178C0A2CB" }, { "vulnerable": true, "criteria": "cpe:2.3:a:cs-cart:cs-cart:1.2:*:*:*:*:*:*:*", "matchCriteriaId": "0FFBA9BB-10CA-4EA4-A164-7B4AEB60BCA1" }, { "vulnerable": true, "criteria": "cpe:2.3:a:cs-cart:cs-cart:1.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "4EA28C65-C87E-47B9-AEB2-A2007851A2DE" }, { "vulnerable": true, "criteria": "cpe:2.3:a:cs-cart:cs-cart:1.3.2:*:*:*:*:*:*:*", "matchCriteriaId": "2560C3BF-C7DC-4645-B278-F86658660ADE" }, { "vulnerable": true, "criteria": "cpe:2.3:a:cs-cart:cs-cart:1.3.2:sp2:*:*:*:*:*:*", "matchCriteriaId": "F6184F41-3EF2-4DDA-A22E-24CF5EA7F008" }, { "vulnerable": true, "criteria": "cpe:2.3:a:cs-cart:cs-cart:1.3.2:sp2:trial_edition:*:*:*:*:*", "matchCriteriaId": "9979A5D8-91BE-4956-A408-DECEADE7D16E" }, { "vulnerable": true, "criteria": "cpe:2.3:a:cs-cart:cs-cart:1.3.3:*:*:*:*:*:*:*", "matchCriteriaId": "48662D7D-F946-45A4-AC02-0A25168154E6" }, { "vulnerable": true, "criteria": "cpe:2.3:a:cs-cart:cs-cart:1.3.5:beta:*:*:*:*:*:*", "matchCriteriaId": "7CFECABA-FEB5-407D-9324-9722E0545B0E" }, { "vulnerable": true, "criteria": "cpe:2.3:a:cs-cart:cs-cart:1.3.5:sp4:*:*:*:*:*:*", "matchCriteriaId": "8F660773-EA54-4596-A22E-951D66C927B0" }, { "vulnerable": true, "criteria": "cpe:2.3:a:cs-cart:cs-cart:1.3.5sp2:*:*:*:*:*:*:*", "matchCriteriaId": "5C4FF089-8732-44B9-8E6C-A78843650899" }, { "vulnerable": true, "criteria": "cpe:2.3:a:cs-cart:cs-cart:1.3.5sp3:*:*:*:*:*:*:*", "matchCriteriaId": "F36E061E-3FB9-4036-97D7-652C6ADCC5C9" }, { "vulnerable": true, "criteria": "cpe:2.3:a:cs-cart:cs-cart:2.0:*:*:*:*:*:*:*", "matchCriteriaId": "24A42E28-C26D-45EF-AAE4-DACFB5985F9D" }, { "vulnerable": true, "criteria": "cpe:2.3:a:cs-cart:cs-cart:2.0:beta:*:*:*:*:*:*", "matchCriteriaId": "A5FA82CA-6192-4339-89BB-6AE5603CBAE1" }, { "vulnerable": true, "criteria": "cpe:2.3:a:cs-cart:cs-cart:2.0:beta2:*:*:*:*:*:*", "matchCriteriaId": "31CEA327-84CE-4B4C-8D27-242EB22A6B4B" }, { "vulnerable": true, "criteria": "cpe:2.3:a:cs-cart:cs-cart:2.0:beta3:*:*:*:*:*:*", "matchCriteriaId": "CC2AB928-9018-4264-A139-1C3826B4F86B" }, { "vulnerable": true, "criteria": "cpe:2.3:a:cs-cart:cs-cart:2.0:rc:*:*:*:*:*:*", "matchCriteriaId": "16980629-1BF0-4ADE-918B-824C6B1AFCB1" }, { "vulnerable": true, "criteria": "cpe:2.3:a:cs-cart:cs-cart:2.0.4:*:*:*:*:*:*:*", "matchCriteriaId": "E17EEE6D-48BD-4BEA-9246-CA3FF6A032C4" } ] } ] } ], "references": [ { "url": "http://secunia.com/advisories/36112", "source": "cve@mitre.org", "tags": [ "Vendor Advisory" ] }, { "url": "http://www.bonsai-sec.com/research/vulnerabilities/cs-cart_SQL-injection-0100.txt", "source": "cve@mitre.org", "tags": [ "Exploit" ] }, { "url": "http://www.cs-cart.com/changelog206.html", "source": "cve@mitre.org" }, { "url": "http://www.securityfocus.com/archive/1/505492/100/0/threaded", "source": "cve@mitre.org" }, { "url": "http://www.securityfocus.com/bid/35936", "source": "cve@mitre.org", "tags": [ "Exploit" ] }, { "url": "http://secunia.com/advisories/36112", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Vendor Advisory" ] }, { "url": "http://www.bonsai-sec.com/research/vulnerabilities/cs-cart_SQL-injection-0100.txt", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Exploit" ] }, { "url": "http://www.cs-cart.com/changelog206.html", "source": "af854a3a-2127-422b-91ae-364da2661108" }, { "url": "http://www.securityfocus.com/archive/1/505492/100/0/threaded", "source": "af854a3a-2127-422b-91ae-364da2661108" }, { "url": "http://www.securityfocus.com/bid/35936", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Exploit" ] } ] }