Description

SQL injection vulnerability in usersettings.php in e107 0.7.15 and earlier, when "Extended User Fields" is enabled and magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the hide parameter, a different vector than CVE-2005-4224 and CVE-2008-5320.

Remediation

References

CVE-2009-1409

Related Vulnerabilities

PleskLin Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-35976)

WordPress Plugin Login With Ajax Cross-Site Scripting (3.0.4)

Drupal Core 9.1.x Cross-Site Scripting (9.1.0 - 9.1.11)

WordPress Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2011-0700)

MyBB Insertion of Sensitive Information into Log File Vulnerability (CVE-2015-8977)

Severity

Medium

Classification

CVE-2009-1409 CWE-138

Tags

Missing Update Known Vulnerabilities