CVE-2010-4834

Estado: ModificadaMedia (6.5)—

Multiple SQL injection vulnerabilities in index.php in OneOrZero AIMS 2.6.0 Members Edition and 2.7.0 Trial Edition allow remote authenticated users to execute arbitrary SQL commands via the (1) id parameter in a saved_search action and (2) item_types parameter in a show_item_search action in the search_management_manage subcontroller. NOTE: some of these details are obtained from third party information.

CVSS

Versión: 2.0
Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Puntuación base: 6.5

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.90%
Percentil entre todas las CVEs puntuadas: 58
Fecha de la puntuación: 5/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Oneorzero — Aims

CWE

CWE-89

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2010-4834",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2011-09-14T02:56:38.143",
  "references": [
    {
      "url": "http://packetstormsecurity.org/files/view/95814/oneorzeroaims-lfisql.txt",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/42251",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://securityreason.com/securityalert/8375",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.exploit-db.com/exploits/15519",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.xenuser.org/documents/security/OneOrZero_Aims_multiple_vulnerabilities.txt",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://packetstormsecurity.org/files/view/95814/oneorzeroaims-lfisql.txt",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/42251",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://securityreason.com/securityalert/8375",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.exploit-db.com/exploits/15519",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.xenuser.org/documents/security/OneOrZero_Aims_multiple_vulnerabilities.txt",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple SQL injection vulnerabilities in index.php in OneOrZero AIMS 2.6.0 Members Edition and 2.7.0 Trial Edition allow remote authenticated users to execute arbitrary SQL commands via the (1) id parameter in a saved_search action and (2) item_types parameter in a show_item_search action in the search_management_manage subcontroller. NOTE: some of these details are obtained from third party information."
    },
    {
      "lang": "es",
      "value": "Múltiples vulnerabilidades de inyección SQL en index.php en OneOrZero AIMS v2.6.0 Members Edition y v2.7.0 Trial Edition permiten a usuarios remotos autenticados ejecutar comandos SQL de su elección a través de (1)el parámetro id  en una acción saved_search y (2) parámetro item_types en una acción show_item_search en el subcontrolador search_management_manage. NOTA: algunos de estos detalles han sido obtenidos de información de terceros."
    }
  ],
  "lastModified": "2026-06-16T23:25:38.093",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oneorzero:aims:2.6.0:*:members:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "12742986-5B52-434C-81B7-5AFC93854B36"
            },
            {
              "criteria": "cpe:2.3:a:oneorzero:aims:2.7.0:*:trial:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5D3E5E15-E4AC-424A-8D3F-750E70C22851"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}