Search criteria

18 vulnerabilities found for family_connections_cms by haudenschilt

FKIE_CVE-2012-0699

Vulnerability from fkie_nvd - Published: 2018-01-11 20:29 - Updated: 2024-11-21 01:35
Severity ?
8.8 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
Multiple cross-site request forgery (CSRF) vulnerabilities in Family Connections CMS (aka FCMS) 2.9 and earlier allow remote attackers to hijack the authentication of arbitrary users for requests that (1) add news via an add action to familynews.php or (2) add a prayer via an add action to prayers.php.
References
cve@mitre.orghttp://www.exploit-db.com/exploits/18667Exploit, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108http://www.exploit-db.com/exploits/18667Exploit, Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
haudenschilt family_connections_cms *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:haudenschilt:family_connections_cms:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "830B6010-0760-46A7-934D-07D58D19F72E",
              "versionEndIncluding": "2.9.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple cross-site request forgery (CSRF) vulnerabilities in Family Connections CMS (aka FCMS) 2.9 and earlier allow remote attackers to hijack the authentication of arbitrary users for requests that (1) add news via an add action to familynews.php or (2) add a prayer via an add action to prayers.php."
    },
    {
      "lang": "es",
      "value": "M\u00faltiples vulnerabilidades de Cross-Site Request Forgery (CSRF) en Family Connections CMS (tambi\u00e9n conocido como FCMS), en versiones 2.9 y anteriores, permiten que atacantes remotos secuestren la autenticaci\u00f3n de usuarios arbitrarios para peticiones que (1) a\u00f1aden noticias mediante una acci\u00f3n add en familynews.php o (2) a\u00f1aden un prayer mediante una acci\u00f3n add en prayers.php."
    }
  ],
  "id": "CVE-2012-0699",
  "lastModified": "2024-11-21T01:35:34.003",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2018-01-11T20:29:00.207",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.exploit-db.com/exploits/18667"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.exploit-db.com/exploits/18667"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2011-5130

Vulnerability from fkie_nvd - Published: 2012-08-30 22:55 - Updated: 2025-04-11 00:51
Severity ?
Summary
dev/less.php in Family Connections CMS (FCMS) 2.5.0 - 2.7.1, when register_globals is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in the argv[1] parameter.
References
cve@mitre.orghttp://osvdb.org/77492
cve@mitre.orghttp://secunia.com/advisories/47069Vendor Advisory
cve@mitre.orghttp://sourceforge.net/apps/trac/fam-connections/ticket/407Exploit
cve@mitre.orghttp://www.exploit-db.com/exploits/18198Exploit
cve@mitre.orghttp://www.exploit-db.com/exploits/18208Exploit
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/71618
cve@mitre.orghttps://www.familycms.com/blog/2011/11/security-vulnerability-fcms-2-5-2-7-1/Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/77492
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/47069Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://sourceforge.net/apps/trac/fam-connections/ticket/407Exploit
af854a3a-2127-422b-91ae-364da2661108http://www.exploit-db.com/exploits/18198Exploit
af854a3a-2127-422b-91ae-364da2661108http://www.exploit-db.com/exploits/18208Exploit
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/71618
af854a3a-2127-422b-91ae-364da2661108https://www.familycms.com/blog/2011/11/security-vulnerability-fcms-2-5-2-7-1/Vendor Advisory
Impacted products
Vendor Product Version
haudenschilt family_connections_cms 2.5.0
haudenschilt family_connections_cms 2.5.1
haudenschilt family_connections_cms 2.5.2
haudenschilt family_connections_cms 2.5.3
haudenschilt family_connections_cms 2.5.4
haudenschilt family_connections_cms 2.6.0
haudenschilt family_connections_cms 2.7.0
haudenschilt family_connections_cms 2.7.1
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:haudenschilt:family_connections_cms:2.5.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "DD3F6566-2950-4125-ADE2-A6D13B21D387",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:haudenschilt:family_connections_cms:2.5.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "8FFCC4C3-F8E6-4080-B37B-C864785D360C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:haudenschilt:family_connections_cms:2.5.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "2D17839D-561A-4CC3-9E61-D04546876352",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:haudenschilt:family_connections_cms:2.5.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "2D637995-835D-43D4-A59A-91D091EB787E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:haudenschilt:family_connections_cms:2.5.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "0254ABA9-7E2C-41C5-8655-97DC5429D4B5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:haudenschilt:family_connections_cms:2.6.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "1CE7AE8E-9E7E-4D06-ACCB-4DED2A3CA0AF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:haudenschilt:family_connections_cms:2.7.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "7CF8B74A-88C8-429C-AA38-B1E7EC35CE3D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:haudenschilt:family_connections_cms:2.7.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "2D1B2E73-D7D4-4665-BF5C-979AFD87553C",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "dev/less.php in Family Connections CMS (FCMS) 2.5.0 - 2.7.1, when register_globals is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in the argv[1] parameter."
    },
    {
      "lang": "es",
      "value": "dev/less.php en Family Connections CMS (FCMS) v2.5.0 - v2.7.1, cuando register_globals es habilitada, permite a atacantes remotos ejecutar comandos arbitrarios a trav\u00e9s de meta caracteres de consola en el par\u00e1metro argv[1]."
    }
  ],
  "id": "CVE-2011-5130",
  "lastModified": "2025-04-11T00:51:21.963",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2012-08-30T22:55:03.983",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/77492"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/47069"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://sourceforge.net/apps/trac/fam-connections/ticket/407"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.exploit-db.com/exploits/18198"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.exploit-db.com/exploits/18208"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/71618"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.familycms.com/blog/2011/11/security-vulnerability-fcms-2-5-2-7-1/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/77492"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/47069"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://sourceforge.net/apps/trac/fam-connections/ticket/407"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.exploit-db.com/exploits/18198"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.exploit-db.com/exploits/18208"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/71618"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.familycms.com/blog/2011/11/security-vulnerability-fcms-2-5-2-7-1/"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2010-3419

Vulnerability from fkie_nvd - Published: 2010-09-16 22:00 - Updated: 2025-04-11 00:51
Severity ?
Summary
Multiple PHP remote file inclusion vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 2.2.3 allow remote attackers to execute arbitrary PHP code via a URL in the current_user_id parameter to (1) familynews.php and (2) settings.php.
References
cve@mitre.orghttp://packetstormsecurity.org/1009-exploits/fcms-rfi.txtExploit
cve@mitre.orghttp://www.exploit-db.com/exploits/14965Exploit
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/61722
af854a3a-2127-422b-91ae-364da2661108http://packetstormsecurity.org/1009-exploits/fcms-rfi.txtExploit
af854a3a-2127-422b-91ae-364da2661108http://www.exploit-db.com/exploits/14965Exploit
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/61722
Impacted products
Vendor Product Version
haudenschilt family_connections_cms 2.2.3
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:haudenschilt:family_connections_cms:2.2.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "16DF0224-7977-450E-949A-B000AC94DF13",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple PHP remote file inclusion vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 2.2.3 allow remote attackers to execute arbitrary PHP code via a URL in the current_user_id parameter to (1) familynews.php and (2) settings.php."
    },
    {
      "lang": "es",
      "value": "M\u00faltiples vulnerabilidades de inclusi\u00f3n remota de archivo PHP en Haudenschilt Family Connections CMS (FCMS) v2.2.3 permite a atacantes remotos ejecutar c\u00f3digo PHP a su elecci\u00f3n a trav\u00e9s de una URL en el par\u00e1metro current_user_id a (1) familynews.php y (2) settings.php."
    }
  ],
  "id": "CVE-2010-3419",
  "lastModified": "2025-04-11T00:51:21.963",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2010-09-16T22:00:02.703",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://packetstormsecurity.org/1009-exploits/fcms-rfi.txt"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.exploit-db.com/exploits/14965"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/61722"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://packetstormsecurity.org/1009-exploits/fcms-rfi.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.exploit-db.com/exploits/14965"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/61722"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2009-2010

Vulnerability from fkie_nvd - Published: 2009-06-08 19:30 - Updated: 2025-04-09 00:30
Severity ?
Summary
Multiple SQL injection vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 1.9 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) thread parameter to messageboard.php, (2) member parameter to profile.php, (3) pid parameter to gallery/index.php, and the (4) fcms_login_id cookie parameter.
References
cve@mitre.orghttp://secunia.com/advisories/35039Vendor Advisory
cve@mitre.orghttp://www.securityfocus.com/archive/1/503477/100/0/threaded
cve@mitre.orghttp://www.securityfocus.com/bid/34935Exploit
cve@mitre.orghttp://www.vupen.com/english/advisories/2009/1306Vendor Advisory
cve@mitre.orghttps://www.exploit-db.com/exploits/8671
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/35039Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/503477/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/34935Exploit
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2009/1306Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.exploit-db.com/exploits/8671
Impacted products
Vendor Product Version
haudenschilt family_connections_cms *
haudenschilt family_connections_cms 0.1.1
haudenschilt family_connections_cms 0.1.2
haudenschilt family_connections_cms 0.5
haudenschilt family_connections_cms 0.6
haudenschilt family_connections_cms 0.8
haudenschilt family_connections_cms 0.9
haudenschilt family_connections_cms 1.4
haudenschilt family_connections_cms 1.8.1
haudenschilt family_connections_cms 1.8.2
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:haudenschilt:family_connections_cms:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9E3BC0B4-9DA5-49B3-BAE1-B05014167EC6",
              "versionEndIncluding": "1.9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:haudenschilt:family_connections_cms:0.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "4A3DC010-D142-4DEB-B425-04B8E10D9AEB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:haudenschilt:family_connections_cms:0.1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "505E59AC-08C9-4D13-8470-76191D73F6A8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:haudenschilt:family_connections_cms:0.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "CBA041C5-5FF4-46A8-9F1D-74025E742EAA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:haudenschilt:family_connections_cms:0.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "D025AEE2-75AF-4959-9E78-E9AB6E163664",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:haudenschilt:family_connections_cms:0.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "0F32130D-8C69-4E23-BC2D-985AF5D41E0B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:haudenschilt:family_connections_cms:0.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "E84E4E37-EAD0-4069-9A23-12941E8E3B8F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:haudenschilt:family_connections_cms:1.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "8C009F6D-C0CB-4CE9-9B0A-9532167FBAB5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:haudenschilt:family_connections_cms:1.8.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "C4790A62-6E63-4D9A-87FF-2D1020E7C7E5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:haudenschilt:family_connections_cms:1.8.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "B944B953-EA7F-4B7D-A8B7-6A7807851ACC",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple SQL injection vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 1.9 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) thread parameter to messageboard.php, (2) member parameter to profile.php, (3) pid parameter to gallery/index.php, and the (4) fcms_login_id cookie parameter."
    },
    {
      "lang": "es",
      "value": "M\u00faltiples vulnerabilidades de inyecci\u00f3n SQL en Haudenschilt Family Connections CMS (FCMS) v1.9 y anteriores, permite a usuarios autenticados ejecutar comandos SQL de su elecci\u00f3n a trav\u00e9s de los par\u00e1metros (1) \"thread\" a messageboard.php, (2) \"member\" a profile.php, (3) \"pid\" a gallery/index.php, y (4) \"fcms_login_id cookie\"."
    }
  ],
  "id": "CVE-2009-2010",
  "lastModified": "2025-04-09T00:30:58.490",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2009-06-08T19:30:00.483",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/35039"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/503477/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/34935"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2009/1306"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.exploit-db.com/exploits/8671"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/35039"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/503477/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/34935"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2009/1306"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.exploit-db.com/exploits/8671"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2008-2901

Vulnerability from fkie_nvd - Published: 2008-06-30 18:24 - Updated: 2025-04-09 00:30
Severity ?
Summary
Multiple SQL injection vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 1.4 allow remote authenticated users to execute arbitrary SQL commands via the (1) address parameter to addressbook.php, the (2) getnews parameter to familynews.php, and the (3) poll_id parameter to home.php in a results action.
References
cve@mitre.orghttp://secunia.com/advisories/30680Vendor Advisory
cve@mitre.orghttp://www.securityfocus.com/bid/29722Exploit
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/43097
cve@mitre.orghttps://www.exploit-db.com/exploits/5811
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/30680Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/29722Exploit
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/43097
af854a3a-2127-422b-91ae-364da2661108https://www.exploit-db.com/exploits/5811
Impacted products
Vendor Product Version
haudenschilt family_connections_cms 1.4
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:haudenschilt:family_connections_cms:1.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "8C009F6D-C0CB-4CE9-9B0A-9532167FBAB5",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple SQL injection vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 1.4 allow remote authenticated users to execute arbitrary SQL commands via the (1) address parameter to addressbook.php, the (2) getnews parameter to familynews.php, and the (3) poll_id parameter to home.php in a results action."
    },
    {
      "lang": "es",
      "value": "M\u00faltiples vulnerabilidades de inyecci\u00f3n SQL en Haudenschilt Family Connections CMS (FCMS) 1.4 permiten a usuarios remotos autenticados ejecutar comandos SQL de su elecci\u00f3n a trav\u00e9s del (1) par\u00e1metro address de addressbook.php, el (2) par\u00e1metro getnews de familynews.php, y el (3) par\u00e1metro poll_id de home.php in en una acci\u00f3n results."
    }
  ],
  "id": "CVE-2008-2901",
  "lastModified": "2025-04-09T00:30:58.490",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": true,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2008-06-30T18:24:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/30680"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/29722"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43097"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.exploit-db.com/exploits/5811"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/30680"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/29722"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43097"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.exploit-db.com/exploits/5811"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2007-4338

Vulnerability from fkie_nvd - Published: 2007-08-14 18:17 - Updated: 2025-04-09 00:30
Severity ?
Summary
index.php in Ryan Haudenschilt Family Connections (FCMS) before 0.9 allows remote attackers to access an arbitrary account by placing the account's name in the value of an fcms_login_id cookie. NOTE: this can be leveraged for code execution via a POST with PHP code in the content parameter.
References
cve@mitre.orghttp://osvdb.org/39534
cve@mitre.orghttp://secunia.com/advisories/26421Vendor Advisory
cve@mitre.orghttp://securityreason.com/securityalert/3009
cve@mitre.orghttp://sourceforge.net/tracker/index.php?func=detail&aid=1778696&group_id=189733&atid=930513
cve@mitre.orghttp://www.attrition.org/pipermail/vim/2007-August/001762.html
cve@mitre.orghttp://www.attrition.org/pipermail/vim/2007-August/001768.html
cve@mitre.orghttp://www.securityfocus.com/archive/1/476142/100/0/threaded
cve@mitre.orghttp://www.securityfocus.com/archive/1/476293/100/0/threaded
cve@mitre.orghttp://www.securityfocus.com/bid/25276Exploit
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/35966
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/39534
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/26421Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://securityreason.com/securityalert/3009
af854a3a-2127-422b-91ae-364da2661108http://sourceforge.net/tracker/index.php?func=detail&aid=1778696&group_id=189733&atid=930513
af854a3a-2127-422b-91ae-364da2661108http://www.attrition.org/pipermail/vim/2007-August/001762.html
af854a3a-2127-422b-91ae-364da2661108http://www.attrition.org/pipermail/vim/2007-August/001768.html
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/476142/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/476293/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/25276Exploit
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/35966
Impacted products
Vendor Product Version
haudenschilt family_connections_cms *
haudenschilt family_connections_cms 0.1.1
haudenschilt family_connections_cms 0.1.2
haudenschilt family_connections_cms 0.5
haudenschilt family_connections_cms 0.6
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:haudenschilt:family_connections_cms:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "7404352F-25A7-472A-BE0C-F4B35EE29E9C",
              "versionEndIncluding": "0.8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:haudenschilt:family_connections_cms:0.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "4A3DC010-D142-4DEB-B425-04B8E10D9AEB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:haudenschilt:family_connections_cms:0.1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "505E59AC-08C9-4D13-8470-76191D73F6A8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:haudenschilt:family_connections_cms:0.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "CBA041C5-5FF4-46A8-9F1D-74025E742EAA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:haudenschilt:family_connections_cms:0.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "D025AEE2-75AF-4959-9E78-E9AB6E163664",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "index.php in Ryan Haudenschilt Family Connections (FCMS) before 0.9 allows remote attackers to access an arbitrary account by placing the account\u0027s name in the value of an fcms_login_id cookie.  NOTE: this can be leveraged for code execution via a POST with PHP code in the content parameter."
    },
    {
      "lang": "es",
      "value": "El archivo index.php en Ryan Haudenschilt Family Connections (FCMS) versiones anteriores a 0.9, permite a atacantes remotos acceder a una cuenta arbitraria mediante la colocaci\u00f3n del nombre de la cuenta en el valor de una cookie de fcms_login_id. NOTA: esto puede ser aprovechado para la ejecuci\u00f3n de c\u00f3digo por medio de un POST con c\u00f3digo PHP en el par\u00e1metro content."
    }
  ],
  "id": "CVE-2007-4338",
  "lastModified": "2025-04-09T00:30:58.490",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 10.0,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 10.0,
        "obtainAllPrivilege": true,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2007-08-14T18:17:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/39534"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/26421"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://securityreason.com/securityalert/3009"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1778696\u0026group_id=189733\u0026atid=930513"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.attrition.org/pipermail/vim/2007-August/001762.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.attrition.org/pipermail/vim/2007-August/001768.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/476142/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/476293/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/25276"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35966"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/39534"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/26421"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securityreason.com/securityalert/3009"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1778696\u0026group_id=189733\u0026atid=930513"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.attrition.org/pipermail/vim/2007-August/001762.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.attrition.org/pipermail/vim/2007-August/001768.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/476142/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/476293/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/25276"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35966"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2012-0699 (GCVE-0-2012-0699)

Vulnerability from cvelistv5 – Published: 2018-01-11 20:00 – Updated: 2024-08-06 18:30
VLAI?
Summary
Multiple cross-site request forgery (CSRF) vulnerabilities in Family Connections CMS (aka FCMS) 2.9 and earlier allow remote attackers to hijack the authentication of arbitrary users for requests that (1) add news via an add action to familynews.php or (2) add a prayer via an add action to prayers.php.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://www.exploit-db.com/exploits/18667 exploitx_refsource_EXPLOIT-DB
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T18:30:53.999Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "18667",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "http://www.exploit-db.com/exploits/18667"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-03-26T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple cross-site request forgery (CSRF) vulnerabilities in Family Connections CMS (aka FCMS) 2.9 and earlier allow remote attackers to hijack the authentication of arbitrary users for requests that (1) add news via an add action to familynews.php or (2) add a prayer via an add action to prayers.php."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-01-11T19:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "18667",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "http://www.exploit-db.com/exploits/18667"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2012-0699",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple cross-site request forgery (CSRF) vulnerabilities in Family Connections CMS (aka FCMS) 2.9 and earlier allow remote attackers to hijack the authentication of arbitrary users for requests that (1) add news via an add action to familynews.php or (2) add a prayer via an add action to prayers.php."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "18667",
              "refsource": "EXPLOIT-DB",
              "url": "http://www.exploit-db.com/exploits/18667"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2012-0699",
    "datePublished": "2018-01-11T20:00:00",
    "dateReserved": "2012-01-14T00:00:00",
    "dateUpdated": "2024-08-06T18:30:53.999Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2011-5130 (GCVE-0-2011-5130)

Vulnerability from cvelistv5 – Published: 2012-08-30 22:00 – Updated: 2024-08-07 00:23
VLAI?
Summary
dev/less.php in Family Connections CMS (FCMS) 2.5.0 - 2.7.1, when register_globals is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in the argv[1] parameter.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://secunia.com/advisories/47069 third-party-advisoryx_refsource_SECUNIA
http://sourceforge.net/apps/trac/fam-connections/… x_refsource_CONFIRM
https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
http://www.exploit-db.com/exploits/18198 exploitx_refsource_EXPLOIT-DB
http://www.exploit-db.com/exploits/18208 exploitx_refsource_EXPLOIT-DB
https://www.familycms.com/blog/2011/11/security-v… x_refsource_CONFIRM
http://osvdb.org/77492 vdb-entryx_refsource_OSVDB
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T00:23:40.127Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "47069",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/47069"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://sourceforge.net/apps/trac/fam-connections/ticket/407"
          },
          {
            "name": "family-connections-less-command-exec(71618)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/71618"
          },
          {
            "name": "18198",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "http://www.exploit-db.com/exploits/18198"
          },
          {
            "name": "18208",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "http://www.exploit-db.com/exploits/18208"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.familycms.com/blog/2011/11/security-vulnerability-fcms-2-5-2-7-1/"
          },
          {
            "name": "77492",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/77492"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2011-11-29T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "dev/less.php in Family Connections CMS (FCMS) 2.5.0 - 2.7.1, when register_globals is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in the argv[1] parameter."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-28T12:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "47069",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/47069"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://sourceforge.net/apps/trac/fam-connections/ticket/407"
        },
        {
          "name": "family-connections-less-command-exec(71618)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/71618"
        },
        {
          "name": "18198",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "http://www.exploit-db.com/exploits/18198"
        },
        {
          "name": "18208",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "http://www.exploit-db.com/exploits/18208"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.familycms.com/blog/2011/11/security-vulnerability-fcms-2-5-2-7-1/"
        },
        {
          "name": "77492",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/77492"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2011-5130",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "dev/less.php in Family Connections CMS (FCMS) 2.5.0 - 2.7.1, when register_globals is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in the argv[1] parameter."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "47069",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/47069"
            },
            {
              "name": "http://sourceforge.net/apps/trac/fam-connections/ticket/407",
              "refsource": "CONFIRM",
              "url": "http://sourceforge.net/apps/trac/fam-connections/ticket/407"
            },
            {
              "name": "family-connections-less-command-exec(71618)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/71618"
            },
            {
              "name": "18198",
              "refsource": "EXPLOIT-DB",
              "url": "http://www.exploit-db.com/exploits/18198"
            },
            {
              "name": "18208",
              "refsource": "EXPLOIT-DB",
              "url": "http://www.exploit-db.com/exploits/18208"
            },
            {
              "name": "https://www.familycms.com/blog/2011/11/security-vulnerability-fcms-2-5-2-7-1/",
              "refsource": "CONFIRM",
              "url": "https://www.familycms.com/blog/2011/11/security-vulnerability-fcms-2-5-2-7-1/"
            },
            {
              "name": "77492",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/77492"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2011-5130",
    "datePublished": "2012-08-30T22:00:00",
    "dateReserved": "2012-08-30T00:00:00",
    "dateUpdated": "2024-08-07T00:23:40.127Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2010-3419 (GCVE-0-2010-3419)

Vulnerability from cvelistv5 – Published: 2010-09-16 21:00 – Updated: 2024-08-07 03:11
VLAI?
Summary
Multiple PHP remote file inclusion vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 2.2.3 allow remote attackers to execute arbitrary PHP code via a URL in the current_user_id parameter to (1) familynews.php and (2) settings.php.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T03:11:43.477Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "14965",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "http://www.exploit-db.com/exploits/14965"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.org/1009-exploits/fcms-rfi.txt"
          },
          {
            "name": "fcms-familynews-file-include(61722)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/61722"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2010-09-10T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple PHP remote file inclusion vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 2.2.3 allow remote attackers to execute arbitrary PHP code via a URL in the current_user_id parameter to (1) familynews.php and (2) settings.php."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-16T14:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "14965",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "http://www.exploit-db.com/exploits/14965"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.org/1009-exploits/fcms-rfi.txt"
        },
        {
          "name": "fcms-familynews-file-include(61722)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/61722"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2010-3419",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple PHP remote file inclusion vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 2.2.3 allow remote attackers to execute arbitrary PHP code via a URL in the current_user_id parameter to (1) familynews.php and (2) settings.php."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "14965",
              "refsource": "EXPLOIT-DB",
              "url": "http://www.exploit-db.com/exploits/14965"
            },
            {
              "name": "http://packetstormsecurity.org/1009-exploits/fcms-rfi.txt",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.org/1009-exploits/fcms-rfi.txt"
            },
            {
              "name": "fcms-familynews-file-include(61722)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/61722"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2010-3419",
    "datePublished": "2010-09-16T21:00:00",
    "dateReserved": "2010-09-16T00:00:00",
    "dateUpdated": "2024-08-07T03:11:43.477Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2009-2010 (GCVE-0-2009-2010)

Vulnerability from cvelistv5 – Published: 2009-06-08 19:00 – Updated: 2024-08-07 05:36
VLAI?
Summary
Multiple SQL injection vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 1.9 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) thread parameter to messageboard.php, (2) member parameter to profile.php, (3) pid parameter to gallery/index.php, and the (4) fcms_login_id cookie parameter.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://secunia.com/advisories/35039 third-party-advisoryx_refsource_SECUNIA
http://www.securityfocus.com/bid/34935 vdb-entryx_refsource_BID
https://www.exploit-db.com/exploits/8671 exploitx_refsource_EXPLOIT-DB
http://www.securityfocus.com/archive/1/503477/100… mailing-listx_refsource_BUGTRAQ
http://www.vupen.com/english/advisories/2009/1306 vdb-entryx_refsource_VUPEN
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T05:36:20.438Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "35039",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/35039"
          },
          {
            "name": "34935",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/34935"
          },
          {
            "name": "8671",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/8671"
          },
          {
            "name": "20090513 (GET var \u0027member\u0027) BLIND SQL INJECTION EXPLOIT --FAMILY CONNECTIONS \u003c= v1.9 --\u003e",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/503477/100/0/threaded"
          },
          {
            "name": "ADV-2009-1306",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/1306"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-05-13T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple SQL injection vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 1.9 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) thread parameter to messageboard.php, (2) member parameter to profile.php, (3) pid parameter to gallery/index.php, and the (4) fcms_login_id cookie parameter."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-10T18:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "35039",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/35039"
        },
        {
          "name": "34935",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/34935"
        },
        {
          "name": "8671",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/8671"
        },
        {
          "name": "20090513 (GET var \u0027member\u0027) BLIND SQL INJECTION EXPLOIT --FAMILY CONNECTIONS \u003c= v1.9 --\u003e",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/503477/100/0/threaded"
        },
        {
          "name": "ADV-2009-1306",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/1306"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2009-2010",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple SQL injection vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 1.9 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) thread parameter to messageboard.php, (2) member parameter to profile.php, (3) pid parameter to gallery/index.php, and the (4) fcms_login_id cookie parameter."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "35039",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/35039"
            },
            {
              "name": "34935",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/34935"
            },
            {
              "name": "8671",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/8671"
            },
            {
              "name": "20090513 (GET var \u0027member\u0027) BLIND SQL INJECTION EXPLOIT --FAMILY CONNECTIONS \u003c= v1.9 --\u003e",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/503477/100/0/threaded"
            },
            {
              "name": "ADV-2009-1306",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/1306"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2009-2010",
    "datePublished": "2009-06-08T19:00:00",
    "dateReserved": "2009-06-08T00:00:00",
    "dateUpdated": "2024-08-07T05:36:20.438Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2008-2901 (GCVE-0-2008-2901)

Vulnerability from cvelistv5 – Published: 2008-06-30 18:00 – Updated: 2024-08-07 09:21
VLAI?
Summary
Multiple SQL injection vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 1.4 allow remote authenticated users to execute arbitrary SQL commands via the (1) address parameter to addressbook.php, the (2) getnews parameter to familynews.php, and the (3) poll_id parameter to home.php in a results action.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
http://secunia.com/advisories/30680 third-party-advisoryx_refsource_SECUNIA
https://www.exploit-db.com/exploits/5811 exploitx_refsource_EXPLOIT-DB
http://www.securityfocus.com/bid/29722 vdb-entryx_refsource_BID
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T09:21:34.512Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "familyconnections-multiple-sql-injection(43097)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43097"
          },
          {
            "name": "30680",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/30680"
          },
          {
            "name": "5811",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/5811"
          },
          {
            "name": "29722",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/29722"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2008-06-14T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple SQL injection vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 1.4 allow remote authenticated users to execute arbitrary SQL commands via the (1) address parameter to addressbook.php, the (2) getnews parameter to familynews.php, and the (3) poll_id parameter to home.php in a results action."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-09-28T12:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "familyconnections-multiple-sql-injection(43097)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43097"
        },
        {
          "name": "30680",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/30680"
        },
        {
          "name": "5811",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/5811"
        },
        {
          "name": "29722",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/29722"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2008-2901",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple SQL injection vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 1.4 allow remote authenticated users to execute arbitrary SQL commands via the (1) address parameter to addressbook.php, the (2) getnews parameter to familynews.php, and the (3) poll_id parameter to home.php in a results action."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "familyconnections-multiple-sql-injection(43097)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43097"
            },
            {
              "name": "30680",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/30680"
            },
            {
              "name": "5811",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/5811"
            },
            {
              "name": "29722",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/29722"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2008-2901",
    "datePublished": "2008-06-30T18:00:00",
    "dateReserved": "2008-06-30T00:00:00",
    "dateUpdated": "2024-08-07T09:21:34.512Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2007-4338 (GCVE-0-2007-4338)

Vulnerability from cvelistv5 – Published: 2007-08-14 18:00 – Updated: 2024-08-07 14:53
VLAI?
Summary
index.php in Ryan Haudenschilt Family Connections (FCMS) before 0.9 allows remote attackers to access an arbitrary account by placing the account's name in the value of an fcms_login_id cookie. NOTE: this can be leveraged for code execution via a POST with PHP code in the content parameter.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://securityreason.com/securityalert/3009 third-party-advisoryx_refsource_SREASON
http://www.securityfocus.com/archive/1/476293/100… mailing-listx_refsource_BUGTRAQ
http://www.securityfocus.com/archive/1/476142/100… mailing-listx_refsource_BUGTRAQ
http://www.securityfocus.com/bid/25276 vdb-entryx_refsource_BID
http://secunia.com/advisories/26421 third-party-advisoryx_refsource_SECUNIA
https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
http://www.attrition.org/pipermail/vim/2007-Augus… mailing-listx_refsource_VIM
http://sourceforge.net/tracker/index.php?func=det… x_refsource_CONFIRM
http://osvdb.org/39534 vdb-entryx_refsource_OSVDB
http://www.attrition.org/pipermail/vim/2007-Augus… mailing-listx_refsource_VIM
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T14:53:55.373Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "3009",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/3009"
          },
          {
            "name": "20070813 Re: FCMS (Family Connections) \u003c= 0.1.1 Remote Command Execution Exploit // www.MefistoLabs.com",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/476293/100/0/threaded"
          },
          {
            "name": "20070811 FCMS (Family Connections) \u003c= 0.1.1 Remote Command Execution Exploit // www.MefistoLabs.com",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/476142/100/0/threaded"
          },
          {
            "name": "25276",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/25276"
          },
          {
            "name": "26421",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/26421"
          },
          {
            "name": "family-fcmsloginid-security-bypass(35966)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35966"
          },
          {
            "name": "20070814 uncertain: FCMS (Family Connections) code execution",
            "tags": [
              "mailing-list",
              "x_refsource_VIM",
              "x_transferred"
            ],
            "url": "http://www.attrition.org/pipermail/vim/2007-August/001762.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1778696\u0026group_id=189733\u0026atid=930513"
          },
          {
            "name": "39534",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/39534"
          },
          {
            "name": "20070823 vendor ACK for CVE-2007-4338 (Familr Connections)",
            "tags": [
              "mailing-list",
              "x_refsource_VIM",
              "x_transferred"
            ],
            "url": "http://www.attrition.org/pipermail/vim/2007-August/001768.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2007-08-11T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "index.php in Ryan Haudenschilt Family Connections (FCMS) before 0.9 allows remote attackers to access an arbitrary account by placing the account\u0027s name in the value of an fcms_login_id cookie.  NOTE: this can be leveraged for code execution via a POST with PHP code in the content parameter."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-15T20:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "3009",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/3009"
        },
        {
          "name": "20070813 Re: FCMS (Family Connections) \u003c= 0.1.1 Remote Command Execution Exploit // www.MefistoLabs.com",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/476293/100/0/threaded"
        },
        {
          "name": "20070811 FCMS (Family Connections) \u003c= 0.1.1 Remote Command Execution Exploit // www.MefistoLabs.com",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/476142/100/0/threaded"
        },
        {
          "name": "25276",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/25276"
        },
        {
          "name": "26421",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/26421"
        },
        {
          "name": "family-fcmsloginid-security-bypass(35966)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35966"
        },
        {
          "name": "20070814 uncertain: FCMS (Family Connections) code execution",
          "tags": [
            "mailing-list",
            "x_refsource_VIM"
          ],
          "url": "http://www.attrition.org/pipermail/vim/2007-August/001762.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1778696\u0026group_id=189733\u0026atid=930513"
        },
        {
          "name": "39534",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/39534"
        },
        {
          "name": "20070823 vendor ACK for CVE-2007-4338 (Familr Connections)",
          "tags": [
            "mailing-list",
            "x_refsource_VIM"
          ],
          "url": "http://www.attrition.org/pipermail/vim/2007-August/001768.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2007-4338",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "index.php in Ryan Haudenschilt Family Connections (FCMS) before 0.9 allows remote attackers to access an arbitrary account by placing the account\u0027s name in the value of an fcms_login_id cookie.  NOTE: this can be leveraged for code execution via a POST with PHP code in the content parameter."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "3009",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/3009"
            },
            {
              "name": "20070813 Re: FCMS (Family Connections) \u003c= 0.1.1 Remote Command Execution Exploit // www.MefistoLabs.com",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/476293/100/0/threaded"
            },
            {
              "name": "20070811 FCMS (Family Connections) \u003c= 0.1.1 Remote Command Execution Exploit // www.MefistoLabs.com",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/476142/100/0/threaded"
            },
            {
              "name": "25276",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/25276"
            },
            {
              "name": "26421",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/26421"
            },
            {
              "name": "family-fcmsloginid-security-bypass(35966)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35966"
            },
            {
              "name": "20070814 uncertain: FCMS (Family Connections) code execution",
              "refsource": "VIM",
              "url": "http://www.attrition.org/pipermail/vim/2007-August/001762.html"
            },
            {
              "name": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1778696\u0026group_id=189733\u0026atid=930513",
              "refsource": "CONFIRM",
              "url": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1778696\u0026group_id=189733\u0026atid=930513"
            },
            {
              "name": "39534",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/39534"
            },
            {
              "name": "20070823 vendor ACK for CVE-2007-4338 (Familr Connections)",
              "refsource": "VIM",
              "url": "http://www.attrition.org/pipermail/vim/2007-August/001768.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2007-4338",
    "datePublished": "2007-08-14T18:00:00",
    "dateReserved": "2007-08-14T00:00:00",
    "dateUpdated": "2024-08-07T14:53:55.373Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2012-0699 (GCVE-0-2012-0699)

Vulnerability from nvd – Published: 2018-01-11 20:00 – Updated: 2024-08-06 18:30
VLAI?
Summary
Multiple cross-site request forgery (CSRF) vulnerabilities in Family Connections CMS (aka FCMS) 2.9 and earlier allow remote attackers to hijack the authentication of arbitrary users for requests that (1) add news via an add action to familynews.php or (2) add a prayer via an add action to prayers.php.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://www.exploit-db.com/exploits/18667 exploitx_refsource_EXPLOIT-DB
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T18:30:53.999Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "18667",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "http://www.exploit-db.com/exploits/18667"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-03-26T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple cross-site request forgery (CSRF) vulnerabilities in Family Connections CMS (aka FCMS) 2.9 and earlier allow remote attackers to hijack the authentication of arbitrary users for requests that (1) add news via an add action to familynews.php or (2) add a prayer via an add action to prayers.php."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-01-11T19:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "18667",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "http://www.exploit-db.com/exploits/18667"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2012-0699",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple cross-site request forgery (CSRF) vulnerabilities in Family Connections CMS (aka FCMS) 2.9 and earlier allow remote attackers to hijack the authentication of arbitrary users for requests that (1) add news via an add action to familynews.php or (2) add a prayer via an add action to prayers.php."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "18667",
              "refsource": "EXPLOIT-DB",
              "url": "http://www.exploit-db.com/exploits/18667"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2012-0699",
    "datePublished": "2018-01-11T20:00:00",
    "dateReserved": "2012-01-14T00:00:00",
    "dateUpdated": "2024-08-06T18:30:53.999Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2011-5130 (GCVE-0-2011-5130)

Vulnerability from nvd – Published: 2012-08-30 22:00 – Updated: 2024-08-07 00:23
VLAI?
Summary
dev/less.php in Family Connections CMS (FCMS) 2.5.0 - 2.7.1, when register_globals is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in the argv[1] parameter.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://secunia.com/advisories/47069 third-party-advisoryx_refsource_SECUNIA
http://sourceforge.net/apps/trac/fam-connections/… x_refsource_CONFIRM
https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
http://www.exploit-db.com/exploits/18198 exploitx_refsource_EXPLOIT-DB
http://www.exploit-db.com/exploits/18208 exploitx_refsource_EXPLOIT-DB
https://www.familycms.com/blog/2011/11/security-v… x_refsource_CONFIRM
http://osvdb.org/77492 vdb-entryx_refsource_OSVDB
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T00:23:40.127Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "47069",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/47069"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://sourceforge.net/apps/trac/fam-connections/ticket/407"
          },
          {
            "name": "family-connections-less-command-exec(71618)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/71618"
          },
          {
            "name": "18198",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "http://www.exploit-db.com/exploits/18198"
          },
          {
            "name": "18208",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "http://www.exploit-db.com/exploits/18208"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.familycms.com/blog/2011/11/security-vulnerability-fcms-2-5-2-7-1/"
          },
          {
            "name": "77492",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/77492"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2011-11-29T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "dev/less.php in Family Connections CMS (FCMS) 2.5.0 - 2.7.1, when register_globals is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in the argv[1] parameter."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-28T12:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "47069",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/47069"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://sourceforge.net/apps/trac/fam-connections/ticket/407"
        },
        {
          "name": "family-connections-less-command-exec(71618)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/71618"
        },
        {
          "name": "18198",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "http://www.exploit-db.com/exploits/18198"
        },
        {
          "name": "18208",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "http://www.exploit-db.com/exploits/18208"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.familycms.com/blog/2011/11/security-vulnerability-fcms-2-5-2-7-1/"
        },
        {
          "name": "77492",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/77492"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2011-5130",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "dev/less.php in Family Connections CMS (FCMS) 2.5.0 - 2.7.1, when register_globals is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in the argv[1] parameter."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "47069",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/47069"
            },
            {
              "name": "http://sourceforge.net/apps/trac/fam-connections/ticket/407",
              "refsource": "CONFIRM",
              "url": "http://sourceforge.net/apps/trac/fam-connections/ticket/407"
            },
            {
              "name": "family-connections-less-command-exec(71618)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/71618"
            },
            {
              "name": "18198",
              "refsource": "EXPLOIT-DB",
              "url": "http://www.exploit-db.com/exploits/18198"
            },
            {
              "name": "18208",
              "refsource": "EXPLOIT-DB",
              "url": "http://www.exploit-db.com/exploits/18208"
            },
            {
              "name": "https://www.familycms.com/blog/2011/11/security-vulnerability-fcms-2-5-2-7-1/",
              "refsource": "CONFIRM",
              "url": "https://www.familycms.com/blog/2011/11/security-vulnerability-fcms-2-5-2-7-1/"
            },
            {
              "name": "77492",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/77492"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2011-5130",
    "datePublished": "2012-08-30T22:00:00",
    "dateReserved": "2012-08-30T00:00:00",
    "dateUpdated": "2024-08-07T00:23:40.127Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2010-3419 (GCVE-0-2010-3419)

Vulnerability from nvd – Published: 2010-09-16 21:00 – Updated: 2024-08-07 03:11
VLAI?
Summary
Multiple PHP remote file inclusion vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 2.2.3 allow remote attackers to execute arbitrary PHP code via a URL in the current_user_id parameter to (1) familynews.php and (2) settings.php.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T03:11:43.477Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "14965",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "http://www.exploit-db.com/exploits/14965"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.org/1009-exploits/fcms-rfi.txt"
          },
          {
            "name": "fcms-familynews-file-include(61722)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/61722"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2010-09-10T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple PHP remote file inclusion vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 2.2.3 allow remote attackers to execute arbitrary PHP code via a URL in the current_user_id parameter to (1) familynews.php and (2) settings.php."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-16T14:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "14965",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "http://www.exploit-db.com/exploits/14965"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.org/1009-exploits/fcms-rfi.txt"
        },
        {
          "name": "fcms-familynews-file-include(61722)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/61722"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2010-3419",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple PHP remote file inclusion vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 2.2.3 allow remote attackers to execute arbitrary PHP code via a URL in the current_user_id parameter to (1) familynews.php and (2) settings.php."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "14965",
              "refsource": "EXPLOIT-DB",
              "url": "http://www.exploit-db.com/exploits/14965"
            },
            {
              "name": "http://packetstormsecurity.org/1009-exploits/fcms-rfi.txt",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.org/1009-exploits/fcms-rfi.txt"
            },
            {
              "name": "fcms-familynews-file-include(61722)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/61722"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2010-3419",
    "datePublished": "2010-09-16T21:00:00",
    "dateReserved": "2010-09-16T00:00:00",
    "dateUpdated": "2024-08-07T03:11:43.477Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2009-2010 (GCVE-0-2009-2010)

Vulnerability from nvd – Published: 2009-06-08 19:00 – Updated: 2024-08-07 05:36
VLAI?
Summary
Multiple SQL injection vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 1.9 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) thread parameter to messageboard.php, (2) member parameter to profile.php, (3) pid parameter to gallery/index.php, and the (4) fcms_login_id cookie parameter.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://secunia.com/advisories/35039 third-party-advisoryx_refsource_SECUNIA
http://www.securityfocus.com/bid/34935 vdb-entryx_refsource_BID
https://www.exploit-db.com/exploits/8671 exploitx_refsource_EXPLOIT-DB
http://www.securityfocus.com/archive/1/503477/100… mailing-listx_refsource_BUGTRAQ
http://www.vupen.com/english/advisories/2009/1306 vdb-entryx_refsource_VUPEN
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T05:36:20.438Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "35039",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/35039"
          },
          {
            "name": "34935",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/34935"
          },
          {
            "name": "8671",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/8671"
          },
          {
            "name": "20090513 (GET var \u0027member\u0027) BLIND SQL INJECTION EXPLOIT --FAMILY CONNECTIONS \u003c= v1.9 --\u003e",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/503477/100/0/threaded"
          },
          {
            "name": "ADV-2009-1306",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/1306"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-05-13T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple SQL injection vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 1.9 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) thread parameter to messageboard.php, (2) member parameter to profile.php, (3) pid parameter to gallery/index.php, and the (4) fcms_login_id cookie parameter."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-10T18:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "35039",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/35039"
        },
        {
          "name": "34935",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/34935"
        },
        {
          "name": "8671",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/8671"
        },
        {
          "name": "20090513 (GET var \u0027member\u0027) BLIND SQL INJECTION EXPLOIT --FAMILY CONNECTIONS \u003c= v1.9 --\u003e",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/503477/100/0/threaded"
        },
        {
          "name": "ADV-2009-1306",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/1306"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2009-2010",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple SQL injection vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 1.9 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) thread parameter to messageboard.php, (2) member parameter to profile.php, (3) pid parameter to gallery/index.php, and the (4) fcms_login_id cookie parameter."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "35039",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/35039"
            },
            {
              "name": "34935",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/34935"
            },
            {
              "name": "8671",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/8671"
            },
            {
              "name": "20090513 (GET var \u0027member\u0027) BLIND SQL INJECTION EXPLOIT --FAMILY CONNECTIONS \u003c= v1.9 --\u003e",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/503477/100/0/threaded"
            },
            {
              "name": "ADV-2009-1306",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/1306"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2009-2010",
    "datePublished": "2009-06-08T19:00:00",
    "dateReserved": "2009-06-08T00:00:00",
    "dateUpdated": "2024-08-07T05:36:20.438Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2008-2901 (GCVE-0-2008-2901)

Vulnerability from nvd – Published: 2008-06-30 18:00 – Updated: 2024-08-07 09:21
VLAI?
Summary
Multiple SQL injection vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 1.4 allow remote authenticated users to execute arbitrary SQL commands via the (1) address parameter to addressbook.php, the (2) getnews parameter to familynews.php, and the (3) poll_id parameter to home.php in a results action.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
http://secunia.com/advisories/30680 third-party-advisoryx_refsource_SECUNIA
https://www.exploit-db.com/exploits/5811 exploitx_refsource_EXPLOIT-DB
http://www.securityfocus.com/bid/29722 vdb-entryx_refsource_BID
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T09:21:34.512Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "familyconnections-multiple-sql-injection(43097)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43097"
          },
          {
            "name": "30680",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/30680"
          },
          {
            "name": "5811",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/5811"
          },
          {
            "name": "29722",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/29722"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2008-06-14T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple SQL injection vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 1.4 allow remote authenticated users to execute arbitrary SQL commands via the (1) address parameter to addressbook.php, the (2) getnews parameter to familynews.php, and the (3) poll_id parameter to home.php in a results action."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-09-28T12:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "familyconnections-multiple-sql-injection(43097)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43097"
        },
        {
          "name": "30680",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/30680"
        },
        {
          "name": "5811",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/5811"
        },
        {
          "name": "29722",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/29722"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2008-2901",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple SQL injection vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 1.4 allow remote authenticated users to execute arbitrary SQL commands via the (1) address parameter to addressbook.php, the (2) getnews parameter to familynews.php, and the (3) poll_id parameter to home.php in a results action."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "familyconnections-multiple-sql-injection(43097)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43097"
            },
            {
              "name": "30680",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/30680"
            },
            {
              "name": "5811",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/5811"
            },
            {
              "name": "29722",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/29722"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2008-2901",
    "datePublished": "2008-06-30T18:00:00",
    "dateReserved": "2008-06-30T00:00:00",
    "dateUpdated": "2024-08-07T09:21:34.512Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2007-4338 (GCVE-0-2007-4338)

Vulnerability from nvd – Published: 2007-08-14 18:00 – Updated: 2024-08-07 14:53
VLAI?
Summary
index.php in Ryan Haudenschilt Family Connections (FCMS) before 0.9 allows remote attackers to access an arbitrary account by placing the account's name in the value of an fcms_login_id cookie. NOTE: this can be leveraged for code execution via a POST with PHP code in the content parameter.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://securityreason.com/securityalert/3009 third-party-advisoryx_refsource_SREASON
http://www.securityfocus.com/archive/1/476293/100… mailing-listx_refsource_BUGTRAQ
http://www.securityfocus.com/archive/1/476142/100… mailing-listx_refsource_BUGTRAQ
http://www.securityfocus.com/bid/25276 vdb-entryx_refsource_BID
http://secunia.com/advisories/26421 third-party-advisoryx_refsource_SECUNIA
https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
http://www.attrition.org/pipermail/vim/2007-Augus… mailing-listx_refsource_VIM
http://sourceforge.net/tracker/index.php?func=det… x_refsource_CONFIRM
http://osvdb.org/39534 vdb-entryx_refsource_OSVDB
http://www.attrition.org/pipermail/vim/2007-Augus… mailing-listx_refsource_VIM
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T14:53:55.373Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "3009",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/3009"
          },
          {
            "name": "20070813 Re: FCMS (Family Connections) \u003c= 0.1.1 Remote Command Execution Exploit // www.MefistoLabs.com",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/476293/100/0/threaded"
          },
          {
            "name": "20070811 FCMS (Family Connections) \u003c= 0.1.1 Remote Command Execution Exploit // www.MefistoLabs.com",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/476142/100/0/threaded"
          },
          {
            "name": "25276",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/25276"
          },
          {
            "name": "26421",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/26421"
          },
          {
            "name": "family-fcmsloginid-security-bypass(35966)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35966"
          },
          {
            "name": "20070814 uncertain: FCMS (Family Connections) code execution",
            "tags": [
              "mailing-list",
              "x_refsource_VIM",
              "x_transferred"
            ],
            "url": "http://www.attrition.org/pipermail/vim/2007-August/001762.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1778696\u0026group_id=189733\u0026atid=930513"
          },
          {
            "name": "39534",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/39534"
          },
          {
            "name": "20070823 vendor ACK for CVE-2007-4338 (Familr Connections)",
            "tags": [
              "mailing-list",
              "x_refsource_VIM",
              "x_transferred"
            ],
            "url": "http://www.attrition.org/pipermail/vim/2007-August/001768.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2007-08-11T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "index.php in Ryan Haudenschilt Family Connections (FCMS) before 0.9 allows remote attackers to access an arbitrary account by placing the account\u0027s name in the value of an fcms_login_id cookie.  NOTE: this can be leveraged for code execution via a POST with PHP code in the content parameter."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-15T20:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "3009",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/3009"
        },
        {
          "name": "20070813 Re: FCMS (Family Connections) \u003c= 0.1.1 Remote Command Execution Exploit // www.MefistoLabs.com",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/476293/100/0/threaded"
        },
        {
          "name": "20070811 FCMS (Family Connections) \u003c= 0.1.1 Remote Command Execution Exploit // www.MefistoLabs.com",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/476142/100/0/threaded"
        },
        {
          "name": "25276",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/25276"
        },
        {
          "name": "26421",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/26421"
        },
        {
          "name": "family-fcmsloginid-security-bypass(35966)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35966"
        },
        {
          "name": "20070814 uncertain: FCMS (Family Connections) code execution",
          "tags": [
            "mailing-list",
            "x_refsource_VIM"
          ],
          "url": "http://www.attrition.org/pipermail/vim/2007-August/001762.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1778696\u0026group_id=189733\u0026atid=930513"
        },
        {
          "name": "39534",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/39534"
        },
        {
          "name": "20070823 vendor ACK for CVE-2007-4338 (Familr Connections)",
          "tags": [
            "mailing-list",
            "x_refsource_VIM"
          ],
          "url": "http://www.attrition.org/pipermail/vim/2007-August/001768.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2007-4338",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "index.php in Ryan Haudenschilt Family Connections (FCMS) before 0.9 allows remote attackers to access an arbitrary account by placing the account\u0027s name in the value of an fcms_login_id cookie.  NOTE: this can be leveraged for code execution via a POST with PHP code in the content parameter."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "3009",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/3009"
            },
            {
              "name": "20070813 Re: FCMS (Family Connections) \u003c= 0.1.1 Remote Command Execution Exploit // www.MefistoLabs.com",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/476293/100/0/threaded"
            },
            {
              "name": "20070811 FCMS (Family Connections) \u003c= 0.1.1 Remote Command Execution Exploit // www.MefistoLabs.com",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/476142/100/0/threaded"
            },
            {
              "name": "25276",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/25276"
            },
            {
              "name": "26421",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/26421"
            },
            {
              "name": "family-fcmsloginid-security-bypass(35966)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35966"
            },
            {
              "name": "20070814 uncertain: FCMS (Family Connections) code execution",
              "refsource": "VIM",
              "url": "http://www.attrition.org/pipermail/vim/2007-August/001762.html"
            },
            {
              "name": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1778696\u0026group_id=189733\u0026atid=930513",
              "refsource": "CONFIRM",
              "url": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1778696\u0026group_id=189733\u0026atid=930513"
            },
            {
              "name": "39534",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/39534"
            },
            {
              "name": "20070823 vendor ACK for CVE-2007-4338 (Familr Connections)",
              "refsource": "VIM",
              "url": "http://www.attrition.org/pipermail/vim/2007-August/001768.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2007-4338",
    "datePublished": "2007-08-14T18:00:00",
    "dateReserved": "2007-08-14T00:00:00",
    "dateUpdated": "2024-08-07T14:53:55.373Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}