CVE-2009-1812

MEDIUM 6.0CVE-2009-1812 · Published 29/05/2009 · updated 16/06/2026

In short

CVE-2009-1812 is a MEDIUM (CVSS 6.0) vulnerability affecting mygesuad (collector).
Chance of exploitation in the next 30 days (EPSS): 0.89%, higher than 59.4% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
mygesuad collector	`= 0.9.14`	No fix yet

Description

Multiple SQL injection vulnerabilities in myGesuad 0.9.14 (aka 0.9) allow remote attackers to execute arbitrary SQL commands via (1) the formUser parameter (aka the Name field) to common/login.php, and allow remote authenticated users to execute arbitrary SQL commands via the ID parameter in a Detail action to (2) kategorie.php, (3) budget.php, (4) zahlung.php, or (5) adresse.php in modules/, related to classes/class.perform.php.

References

secunia.com/advisories/35110 · Vendor Advisory
collector.ch/drupal5 · Patch
securityfocus.com/bid/34998 · Exploit
vupen.com/english/advisories/2009/1345
exploit-db.com/exploits/8708

More vulnerabilities in mygesuad

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free