SQL Injection in Roman Bogorodskiy Nforum

CVE-2009-0882

Multiple SQL injection vulnerabilities in nForum 1.5 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to showtheme.php and the (2) user parameter to userinfo.php.

Vulnerability class: SQL Injection

EPSS: 0.009 (56.3th percentile) — read the EPSS interpretation.

Affected products

Roman_bogorodskiy Nforum — versions 1.5
N/a — versions n/a

Weakness classification (CWE)

CWE-89 — SQL Injection

References

cve@mitre.org (Exploit, vdb-entry, x_refsource_BID)
cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)