CVE-2009-4625

SQL injection vulnerability in the updateOnePage function in components/com_bfsurvey_pro/controller.php in BF Survey Pro Free (com_bfsurvey_profree) 1.2.4, and other versions before 1.2.6, a component for Joomla!, allows remote attackers to execute arbitrary SQL commands via the table parameter in an updateOnePage action to index.php.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:P/I:P/A:P
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 41%
VendorProductVersion
tamlyncreativecom_bfsurvey_profree
𝑥
≤ 1.2.5
tamlyncreativecom_bfsurvey_profree
1.2.4
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://osvdb.org/57883
http://secunia.com/advisories/36657
http://www.exploit-db.com/exploits/9601
http://www.tamlyncreative.com.au/software/forum/index.php?topic=357.msg1334#msg1334
http://www.vupen.com/english/advisories/2009/2609
https://exchange.xforce.ibmcloud.com/vulnerabilities/53107
http://osvdb.org/57883
http://secunia.com/advisories/36657
http://www.exploit-db.com/exploits/9601
http://www.tamlyncreative.com.au/software/forum/index.php?topic=357.msg1334#msg1334
http://www.vupen.com/english/advisories/2009/2609
https://exchange.xforce.ibmcloud.com/vulnerabilities/53107