{"api_version":"1","generated_at":"2026-07-23T10:06:29+00:00","cve":"CVE-2009-2308","urls":{"html":"https://cve.report/CVE-2009-2308","api":"https://cve.report/api/cve/CVE-2009-2308.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2009-2308","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2009-2308"},"summary":{"title":"CVE-2009-2308","description":"Multiple SQL injection vulnerabilities in affiliates.php in the Affiliation (aka Affiliates) module 1.1.0 and earlier for PunBB allow remote attackers to execute arbitrary SQL commands via the (1) in or (2) out parameter.","state":"PUBLISHED","assigner":"mitre","published_at":"2009-07-02 10:30:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-89","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/51437","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/51437","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://packetstormsecurity.org/0906-exploits/punbbaffiliations-blindsql.txt","name":"http://packetstormsecurity.org/0906-exploits/punbbaffiliations-blindsql.txt","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"Files ≈ Packet Storm","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.exploit-db.com/exploits/9055","name":"http://www.exploit-db.com/exploits/9055","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"PunBB Affiliates Mod <= 1.1 Remote Blind SQL Injection Exploit","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://packetstormsecurity.org/0906-exploits/punbbaffiliationsin-blindsql.txt","name":"http://packetstormsecurity.org/0906-exploits/punbbaffiliationsin-blindsql.txt","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"Files ≈ Packet Storm","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.osvdb.org/55478","name":"http://www.osvdb.org/55478","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://secunia.com/advisories/35654","name":"http://secunia.com/advisories/35654","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"PunBB Affiliation Module SQL Injection Vulnerabilities - Secunia Advisories - Vulnerability Information - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-2308","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-2308","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2009","cve_id":"2308","vulnerable":"0","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"punbb","cpe5":"punbb","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"2308","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"punres","cpe5":"affiliates_mod","cpe6":"1.0.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"2308","vulnerable":"1","versionEndIncluding":"1.1.0","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"punres","cpe5":"affiliates_mod","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T05:44:55.934Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"9055","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"],"url":"http://www.exploit-db.com/exploits/9055"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://packetstormsecurity.org/0906-exploits/punbbaffiliationsin-blindsql.txt"},{"name":"55478","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://www.osvdb.org/55478"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://packetstormsecurity.org/0906-exploits/punbbaffiliations-blindsql.txt"},{"name":"35654","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/35654"},{"name":"affiliation-affiliates-sql-injection(51437)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/51437"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2009-06-29T00:00:00.000Z","descriptions":[{"lang":"en","value":"Multiple SQL injection vulnerabilities in affiliates.php in the Affiliation (aka Affiliates) module 1.1.0 and earlier for PunBB allow remote attackers to execute arbitrary SQL commands via the (1) in or (2) out parameter."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-09-18T12:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"9055","tags":["exploit","x_refsource_EXPLOIT-DB"],"url":"http://www.exploit-db.com/exploits/9055"},{"tags":["x_refsource_MISC"],"url":"http://packetstormsecurity.org/0906-exploits/punbbaffiliationsin-blindsql.txt"},{"name":"55478","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://www.osvdb.org/55478"},{"tags":["x_refsource_MISC"],"url":"http://packetstormsecurity.org/0906-exploits/punbbaffiliations-blindsql.txt"},{"name":"35654","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/35654"},{"name":"affiliation-affiliates-sql-injection(51437)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/51437"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2009-2308","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple SQL injection vulnerabilities in affiliates.php in the Affiliation (aka Affiliates) module 1.1.0 and earlier for PunBB allow remote attackers to execute arbitrary SQL commands via the (1) in or (2) out parameter."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"9055","refsource":"EXPLOIT-DB","url":"http://www.exploit-db.com/exploits/9055"},{"name":"http://packetstormsecurity.org/0906-exploits/punbbaffiliationsin-blindsql.txt","refsource":"MISC","url":"http://packetstormsecurity.org/0906-exploits/punbbaffiliationsin-blindsql.txt"},{"name":"55478","refsource":"OSVDB","url":"http://www.osvdb.org/55478"},{"name":"http://packetstormsecurity.org/0906-exploits/punbbaffiliations-blindsql.txt","refsource":"MISC","url":"http://packetstormsecurity.org/0906-exploits/punbbaffiliations-blindsql.txt"},{"name":"35654","refsource":"SECUNIA","url":"http://secunia.com/advisories/35654"},{"name":"affiliation-affiliates-sql-injection(51437)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/51437"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2009-2308","datePublished":"2009-07-02T10:00:00.000Z","dateReserved":"2009-07-02T00:00:00.000Z","dateUpdated":"2024-08-07T05:44:55.934Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2009-07-02 10:30:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-89","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:a:punbb:punbb:*:*:*:*:*:*:*:*","matchCriteriaId":"F9B94FB2-2C83-42D6-BECC-D39E97594CA4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:punres:affiliates_mod:*:*:*:*:*:*:*:*","versionEndIncluding":"1.1.0","matchCriteriaId":"4359BE72-D905-4D00-B08A-6BD27CE07FE2"},{"vulnerable":true,"criteria":"cpe:2.3:a:punres:affiliates_mod:1.0.0:*:*:*:*:*:*:*","matchCriteriaId":"54BF6E51-01A6-417D-8F6D-86523D6E87A6"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2009","CveId":"2308","Ordinal":"1","Title":"CVE-2009-2308","CVE":"CVE-2009-2308","Year":"2009"},"notes":[{"CveYear":"2009","CveId":"2308","Ordinal":"1","NoteData":"Multiple SQL injection vulnerabilities in affiliates.php in the Affiliation (aka Affiliates) module 1.1.0 and earlier for PunBB allow remote attackers to execute arbitrary SQL commands via the (1) in or (2) out parameter.","Type":"Description","Title":"CVE-2009-2308"},{"CveYear":"2009","CveId":"2308","Ordinal":"2","NoteData":"2009-07-02","Type":"Other","Title":"Published"},{"CveYear":"2009","CveId":"2308","Ordinal":"3","NoteData":"2017-09-18","Type":"Other","Title":"Modified"}]}}}