Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2009-2372

EPSS 1.13% · P78
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2009-2372

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
Drupal 6.x before 6.13 does not prevent users from modifying user signatures after the associated comment format has been changed to an administrator-controlled input format, which allows remote authenticated users to inject arbitrary web script, HTML, and possibly PHP code via a crafted user signature.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Drupal 代码注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Drupal是Drupal社区的一套使用PHP语言开发的开源内容管理系统。 Drupal存在代码注入漏洞。该漏洞源于在关联注释格式被改变成管理员控制的输入格式后，并未阻止用户修改用户签名，这使得远程认证用户可以借助一个特制的用户签名注入任意的Web脚本、HTML以及可能PHP代码。 受影响软件包括Drupal 6.13之前的6.x版本
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
-n/a n/a -

II. Public POCs for CVE-2009-2372

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2009-2372

请登录查看更多情报信息。

Same Patch Batch · n/a · 2009-07-08 · 26 CVEs total

CVE-2009-2373Drupal Forum module 跨站脚本攻击漏洞
CVE-2009-2385Fustrate Simple Machines Forum Member Awards 'index.php' SQL注入漏洞
CVE-2009-2384Mathi Brothersoft PEamp a .m3u playlist 缓冲区溢出漏洞
CVE-2009-2383Blogtrafficexchange Related Sites插件BTE_RW_webajax.php SQL注入漏洞
CVE-2009-2382jay-jayx0r phpmyblockchecker admin.php 用户认证及访问控制漏洞
CVE-2009-2381Gizmo5 for Linux MSN Authentication SSL Certificate Validation 安全绕过漏洞
CVE-2009-23804homepages 4images functions.php 跨站脚本攻击漏洞
CVE-2009-2379BIGACE Web CMS 'public/index.php' 远程目录遍历漏洞
CVE-2009-2378jtr jax_formmailer.admin.inc.php 代码注入漏洞
CVE-2009-2377Avax Vector avPreview.ocx控件PrinterName属性缓冲区溢出漏洞
CVE-2009-2376TangoCMS textarea ‘application/libraries/Html.php’跨站脚本攻击漏洞
CVE-2009-2375Photo DVD Maker项目文件解析栈溢出漏洞
CVE-2009-2374Drupal 信任管理问题漏洞
CVE-2009-2360Horde Passwd模块‘passwd/main.php’ 跨站脚本攻击漏洞
CVE-2009-2371Drupal Advanced Forum模块权限许可和访问控制漏洞
CVE-2009-2370Drupal Advanced Forum模块跨站脚本攻击漏洞
CVE-2009-2369wxWidgets wxImage::Create()函数整数溢出漏洞
CVE-2009-2368matteo_ricchetti ss5 未明漏洞
CVE-2009-2367iomega storcenter_pro makecgi-pro 加密强度安全漏洞
CVE-2009-2366datachecknh forumpal login.asp SQL注入漏洞

Showing top 20 of 26 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: n/a
Same vendor: n/a

V. Comments for CVE-2009-2372

No comments yet

Leave a comment