« Volver al listado

CVE-2009-4865

Estado: ModificadaMedia (6.8)—

Multiple SQL injection vulnerabilities in escorts_search.php in I-Escorts Directory Script and Agency Script, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) search_name and (2) languages parameters. NOTE: some of these details are obtained from third party information.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

I-escorts — I-escorts Agency ScriptI-escorts — I-escorts Directory Script

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2009-4865",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2010-05-11T12:02:09.300",
  "references": [
    {
      "url": "http://osvdb.org/56858",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://packetstormsecurity.org/0908-exploits/des-xss.txt",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/36161",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/52304",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/56858",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://packetstormsecurity.org/0908-exploits/des-xss.txt",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/36161",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/52304",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple SQL injection vulnerabilities in escorts_search.php in I-Escorts Directory Script and Agency Script, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) search_name and (2) languages parameters.  NOTE: some of these details are obtained from third party information."
    },
    {
      "lang": "es",
      "value": "Múltiples vulnerabilidades de inyección SQL en escorts_search.php en I-Escorts Directory Script y Agency Script, cuando magic_quotes_gpc está deshabilitado, permite a atacantes remotos ejecutar comandos arbitrarios de SQL a través de (1) el parámetro search_name y (2) el parámetro languages. Nota: algunos de estos detalles se han obtenido de información de terceros."
    }
  ],
  "lastModified": "2026-06-16T23:14:30.200",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:i-escorts:i-escorts_agency_script:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "51848B1C-3842-4FE5-B95D-1183E546015F"
            },
            {
              "criteria": "cpe:2.3:a:i-escorts:i-escorts_directory_script:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D0C870E0-C800-4C2D-92A8-61403CB5D232"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}