Description

Multiple SQL injection vulnerabilities in FrontAccounting (FA) before 2.1.7 allow remote attackers to execute arbitrary SQL commands via unspecified parameters to various .inc and .php files in (1) reporting/, (2) sales/, (3) sales/includes/, (4) sales/includes/db/, (5) sales/inquiry/, (6) sales/manage/, (7) sales/view/, (8) taxes/, and (9) taxes/db/.

Remediation

References

CVE-2009-4045

Related Vulnerabilities

WordPress Plugin Clicky by Yoast Multiple Cross-Site Scripting Vulnerabilities (1.5)

Drupal Core 8.7.0 Directory Traversal (8.7.0)

Grafana Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-41174)

Java Unspesificed Vulnerability (CVE-2018-3139)

Drupal Core 8.x.x Arbitrary File Overwrite (8.0.0 - 8.7.14)

Severity

High

Classification

CVE-2009-4045 CWE-138

Tags

Missing Update Known Vulnerabilities