ByteOS Network

NVD Vulnerability Details :

CVE-2011-3688

Deferred

Source-cve@mitre.org

Published At-27 Sep, 2011 | 19:55

Updated At-11 Apr, 2025 | 00:51

Multiple SQL injection vulnerabilities in Sonexis ConferenceManager 9.3.14.0 allow remote attackers to execute arbitrary SQL commands via (1) the g parameter to Conference/Audio/AudioResourceContainer.asp or (2) the txtConferenceID parameter to Login/HostLogin.asp.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	2.0	7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P
Primary	2.0	7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P

Type: Primary

Version: 2.0

Base score: 7.5

Base severity: HIGH

Vector:

AV:N/AC:L/Au:N/C:P/I:P/A:P

Type: Primary

Version: 2.0

Base score: 7.5

Base severity: HIGH

Vector:

AV:N/AC:L/Au:N/C:P/I:P/A:P

CPE Matches

sonexis>>conferencemanager>>9.3.14.0

cpe:2.3:a:sonexis:conferencemanager:9.3.14.0:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-89	Primary	nvd@nist.gov

CWE ID: CWE-89

Type: Primary

Source: nvd@nist.gov

Vendor Statements

Organization : Sonexis

Last Modified : 2012-08-17T00:00:00

Version 9.3 Patch 12 and 10.0.40 Patch 2 were available to customers in early October 2011. V9.2.11 is no longer supported and customers with support are able to upgrade to our latest release which includes the fixes. All customers were notified of the vulnerabilities and the fixes in early October 2011.

References

Hyperlink	Source	Resource
http://securityreason.com/securityalert/8401	cve@mitre.org	N/A
http://www.solutionary.com/index/SERT/Vuln-Disclosures/Sonexis-SQL-Injection.html	cve@mitre.org	Exploit
http://securityreason.com/securityalert/8401	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.solutionary.com/index/SERT/Vuln-Disclosures/Sonexis-SQL-Injection.html	af854a3a-2127-422b-91ae-364da2661108	Exploit