{"api_version":"1","generated_at":"2026-07-23T11:12:21+00:00","cve":"CVE-2009-4437","urls":{"html":"https://cve.report/CVE-2009-4437","api":"https://cve.report/api/cve/CVE-2009-4437.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2009-4437","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2009-4437"},"summary":{"title":"CVE-2009-4437","description":"Multiple SQL injection vulnerabilities in Active Auction House 3.6 allow remote attackers to execute arbitrary SQL commands via the (1) catid parameter to wishlist.asp and the (2) linkid parameter to links.asp.  NOTE: vector 1 might overlap CVE-2005-1029.1.","state":"PUBLISHED","assigner":"mitre","published_at":"2009-12-28 19:00:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-89","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://packetstormsecurity.org/0912-exploits/activeauctionhouse-sql.txt","name":"http://packetstormsecurity.org/0912-exploits/activeauctionhouse-sql.txt","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"Files ≈ Packet Storm","mime":"text/plain","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/54891","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/54891","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/14839","name":"http://secunia.com/advisories/14839","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Active Auction House Cross-Site Scripting and SQL Injection - Secunia Advisories - Vulnerability Information - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/37401","name":"http://www.securityfocus.com/bid/37401","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"Active Auction House Multiple SQL Injection Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.exploit-db.com/exploits/10520","name":"http://www.exploit-db.com/exploits/10520","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"Active Auction House v 3.6  Blind SQL Injection Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-4437","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-4437","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2009","cve_id":"4437","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"activewebsoftwares","cpe5":"active_auction_house","cpe6":"3.6","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T07:01:20.270Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_MISC","x_transferred"],"url":"http://packetstormsecurity.org/0912-exploits/activeauctionhouse-sql.txt"},{"name":"activeauctionhouse-links-sql-injection(54891)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/54891"},{"name":"37401","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/37401"},{"name":"10520","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"],"url":"http://www.exploit-db.com/exploits/10520"},{"name":"14839","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/14839"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2009-12-17T00:00:00.000Z","descriptions":[{"lang":"en","value":"Multiple SQL injection vulnerabilities in Active Auction House 3.6 allow remote attackers to execute arbitrary SQL commands via the (1) catid parameter to wishlist.asp and the (2) linkid parameter to links.asp.  NOTE: vector 1 might overlap CVE-2005-1029.1."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-08-16T14:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"tags":["x_refsource_MISC"],"url":"http://packetstormsecurity.org/0912-exploits/activeauctionhouse-sql.txt"},{"name":"activeauctionhouse-links-sql-injection(54891)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/54891"},{"name":"37401","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/37401"},{"name":"10520","tags":["exploit","x_refsource_EXPLOIT-DB"],"url":"http://www.exploit-db.com/exploits/10520"},{"name":"14839","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/14839"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2009-4437","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple SQL injection vulnerabilities in Active Auction House 3.6 allow remote attackers to execute arbitrary SQL commands via the (1) catid parameter to wishlist.asp and the (2) linkid parameter to links.asp.  NOTE: vector 1 might overlap CVE-2005-1029.1."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"http://packetstormsecurity.org/0912-exploits/activeauctionhouse-sql.txt","refsource":"MISC","url":"http://packetstormsecurity.org/0912-exploits/activeauctionhouse-sql.txt"},{"name":"activeauctionhouse-links-sql-injection(54891)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/54891"},{"name":"37401","refsource":"BID","url":"http://www.securityfocus.com/bid/37401"},{"name":"10520","refsource":"EXPLOIT-DB","url":"http://www.exploit-db.com/exploits/10520"},{"name":"14839","refsource":"SECUNIA","url":"http://secunia.com/advisories/14839"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2009-4437","datePublished":"2009-12-28T18:27:00.000Z","dateReserved":"2009-12-28T00:00:00.000Z","dateUpdated":"2024-08-07T07:01:20.270Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2009-12-28 19:00:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-89","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:activewebsoftwares:active_auction_house:3.6:*:*:*:*:*:*:*","matchCriteriaId":"18134A1B-8FC6-4376-9AB9-42D318D28DF3"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2009","CveId":"4437","Ordinal":"1","Title":"CVE-2009-4437","CVE":"CVE-2009-4437","Year":"2009"},"notes":[{"CveYear":"2009","CveId":"4437","Ordinal":"1","NoteData":"Multiple SQL injection vulnerabilities in Active Auction House 3.6 allow remote attackers to execute arbitrary SQL commands via the (1) catid parameter to wishlist.asp and the (2) linkid parameter to links.asp.  NOTE: vector 1 might overlap CVE-2005-1029.1.","Type":"Description","Title":"CVE-2009-4437"},{"CveYear":"2009","CveId":"4437","Ordinal":"2","NoteData":"2009-12-28","Type":"Other","Title":"Published"},{"CveYear":"2009","CveId":"4437","Ordinal":"3","NoteData":"2017-08-16","Type":"Other","Title":"Modified"}]}}}