SQL Injection in Arabportal Arab Portal

CVE-2009-2781

SQL injection vulnerability in forum.php in Arab Portal 2.x, when magic_quotes_gpc is disabled, allows remote authenticated users to execute arbitrary SQL commands via the qc parameter in an addcomment action, a different vector than CVE-2006-1666.

Vulnerability class: SQL Injection

EPSS: 0.007 (50.6th percentile) — read the EPSS interpretation.

Affected products

Arabportal Arab_portal — versions 2.0.1, 2.1, 2.2
N/a — versions n/a

Weakness classification (CWE)

CWE-89 — SQL Injection

References

cve@mitre.org (exploit, x_refsource_EXPLOIT-DB)
cve@mitre.org (Exploit, vdb-entry, x_refsource_BID)