{"api_version":"1","generated_at":"2026-07-23T09:04:45+00:00","cve":"CVE-2009-4798","urls":{"html":"https://cve.report/CVE-2009-4798","api":"https://cve.report/api/cve/CVE-2009-4798.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2009-4798","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2009-4798"},"summary":{"title":"CVE-2009-4798","description":"Multiple SQL injection vulnerabilities in Diskos CMS 6.x allow remote attackers to execute arbitrary SQL commands via the (1) kat parameter to side.asp, and the (2) brugerid and (3) password fields to the administration login feature.","state":"PUBLISHED","assigner":"mitre","published_at":"2010-04-22 14:30:00","updated_at":"2026-04-29 01:13:23"},"problem_types":["CWE-89","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://secunia.com/advisories/34540","name":"http://secunia.com/advisories/34540","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Diskos CMS SQL Injection and Database Disclosure - Secunia Advisories - Vulnerability Information - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/49509","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/49509","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/49510","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/49510","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.exploit-db.com/exploits/8307","name":"http://www.exploit-db.com/exploits/8307","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Diskos CMS Manager (SQL/DB/Auth Bypass) Multiple Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/34289","name":"http://www.securityfocus.com/bid/34289","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"Diskos CMS Manager Multiple SQL Injection Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-4798","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-4798","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2009","cve_id":"4798","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"diskos","cpe5":"diskos_cms","cpe6":"6","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T07:17:25.665Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"8307","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"],"url":"http://www.exploit-db.com/exploits/8307"},{"name":"34289","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/34289"},{"name":"diskos-side-sql-injection(49509)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/49509"},{"name":"diskos-login-sql-injection(49510)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/49510"},{"name":"34540","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/34540"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2009-03-30T00:00:00.000Z","descriptions":[{"lang":"en","value":"Multiple SQL injection vulnerabilities in Diskos CMS 6.x allow remote attackers to execute arbitrary SQL commands via the (1) kat parameter to side.asp, and the (2) brugerid and (3) password fields to the administration login feature."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-09-18T12:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"8307","tags":["exploit","x_refsource_EXPLOIT-DB"],"url":"http://www.exploit-db.com/exploits/8307"},{"name":"34289","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/34289"},{"name":"diskos-side-sql-injection(49509)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/49509"},{"name":"diskos-login-sql-injection(49510)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/49510"},{"name":"34540","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/34540"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2009-4798","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple SQL injection vulnerabilities in Diskos CMS 6.x allow remote attackers to execute arbitrary SQL commands via the (1) kat parameter to side.asp, and the (2) brugerid and (3) password fields to the administration login feature."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"8307","refsource":"EXPLOIT-DB","url":"http://www.exploit-db.com/exploits/8307"},{"name":"34289","refsource":"BID","url":"http://www.securityfocus.com/bid/34289"},{"name":"diskos-side-sql-injection(49509)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/49509"},{"name":"diskos-login-sql-injection(49510)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/49510"},{"name":"34540","refsource":"SECUNIA","url":"http://secunia.com/advisories/34540"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2009-4798","datePublished":"2010-04-22T14:00:00.000Z","dateReserved":"2010-04-22T00:00:00.000Z","dateUpdated":"2024-08-07T07:17:25.665Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2010-04-22 14:30:00","lastModifiedDate":"2026-04-29 01:13:23","problem_types":["CWE-89","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:diskos:diskos_cms:6:*:*:*:*:*:*:*","matchCriteriaId":"15ADA1C5-2EDB-404B-8975-1839F76D9E58"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2009","CveId":"4798","Ordinal":"1","Title":"CVE-2009-4798","CVE":"CVE-2009-4798","Year":"2009"},"notes":[{"CveYear":"2009","CveId":"4798","Ordinal":"1","NoteData":"Multiple SQL injection vulnerabilities in Diskos CMS 6.x allow remote attackers to execute arbitrary SQL commands via the (1) kat parameter to side.asp, and the (2) brugerid and (3) password fields to the administration login feature.","Type":"Description","Title":"CVE-2009-4798"},{"CveYear":"2009","CveId":"4798","Ordinal":"2","NoteData":"2010-04-22","Type":"Other","Title":"Published"},{"CveYear":"2009","CveId":"4798","Ordinal":"3","NoteData":"2017-09-18","Type":"Other","Title":"Modified"}]}}}