e107 Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) Vulnerability - CVE-2009-1409 - Vulnerability Database

e107

e107 Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) Vulnerability - CVE-2009-1409

Medium

Reference: CVE-2009-1409

NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2009-1409

Title: e107 Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) Vulnerability

Overview:

SQL injection vulnerability in usersettings.php in e107 0.7.15 and earlier when quotExtended User Fieldsquot is enabled and magic_quotes_gpc is disabled allows remote attackers to execute arbitrary SQL commands via the hide parameter a different vector than CVE-2005-4224 and CVE-2008-5320.