SQL Injection in Fretsweb Project
CVE-2009-2113
Multiple SQL injection vulnerabilities in FretsWeb 1.2 allow remote attackers to execute arbitrary SQL commands via the (1) name parameter to player.php and the (2) hash parameter to song.php.
Vulnerability class: SQL Injection
EPSS: 0.026 (83.5th percentile) — read the EPSS interpretation.
Affected products
- Fretsweb_project Fretsweb — versions 1.2
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (VDB Entry, Third Party Advisory, exploit, x_refsource_EXPLOIT-DB)
- cve@mitre.org (x_refsource_CONFIRM, Patch)
- cve@mitre.org (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
- cve@mitre.org (x_refsource_OSVDB, vdb-entry, Broken Link)
- cve@mitre.org (x_refsource_OSVDB, vdb-entry, Broken Link)