ByteOS Network

NVD Vulnerability Details :

CVE-2009-4046

Analyzed

Source-cve@mitre.org

Published At-20 Nov, 2009 | 19:30

Updated At-23 Nov, 2009 | 05:00

Multiple SQL injection vulnerabilities in FrontAccounting (FA) 2.2.x before 2.2 RC allow remote attackers to execute arbitrary SQL commands via unspecified parameters to (1) bank_accounts.php, (2) currencies.php, (3) exchange_rates.php, (4) gl_account_types.php, and (5) gl_accounts.php in gl/manage/; and (6) audit_trail_db.inc, (7) comments_db.inc, (8) inventory_db.inc, (9) manufacturing_db.inc, and (10) references_db.inc in includes/db/.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	2.0	7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P

Type: Primary

Version: 2.0

Base score: 7.5

Base severity: HIGH

Vector:

AV:N/AC:L/Au:N/C:P/I:P/A:P

CPE Matches

frontaccounting>>frontaccounting>>2.2

cpe:2.3:a:frontaccounting:frontaccounting:2.2:beta:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-89	Primary	nvd@nist.gov

CWE ID: CWE-89

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://frontaccounting.net/wb3/pages/posts/release-2.2-rc104.php	cve@mitre.org	Patch
http://sourceforge.net/projects/frontaccounting/files/FrontAccounting-2/2.2%20RC/frontaccount-2.2RC.tar.gz/download	cve@mitre.org	Patch
http://www.vupen.com/english/advisories/2009/3223	cve@mitre.org	Vendor Advisory

Hyperlink: http://frontaccounting.net/wb3/pages/posts/release-2.2-rc104.php

Source: cve@mitre.org

Resource:

Patch

Hyperlink: http://sourceforge.net/projects/frontaccounting/files/FrontAccounting-2/2.2%20RC/frontaccount-2.2RC.tar.gz/download

Source: cve@mitre.org

Resource:

Patch

Hyperlink: http://www.vupen.com/english/advisories/2009/3223

Source: cve@mitre.org

Resource:

Vendor Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History