Vulnerabilites related to haudenschilt - family_connections_cms
CVE-2007-4338 (GCVE-0-2007-4338)
Vulnerability from cvelistv5
Published
2007-08-14 18:00
Modified
2024-08-07 14:53
Severity ?
CWE
  • n/a
Summary
index.php in Ryan Haudenschilt Family Connections (FCMS) before 0.9 allows remote attackers to access an arbitrary account by placing the account's name in the value of an fcms_login_id cookie. NOTE: this can be leveraged for code execution via a POST with PHP code in the content parameter.
References
http://securityreason.com/securityalert/3009third-party-advisory, x_refsource_SREASON
http://www.securityfocus.com/archive/1/476293/100/0/threadedmailing-list, x_refsource_BUGTRAQ
http://www.securityfocus.com/archive/1/476142/100/0/threadedmailing-list, x_refsource_BUGTRAQ
http://www.securityfocus.com/bid/25276vdb-entry, x_refsource_BID
http://secunia.com/advisories/26421third-party-advisory, x_refsource_SECUNIA
https://exchange.xforce.ibmcloud.com/vulnerabilities/35966vdb-entry, x_refsource_XF
http://www.attrition.org/pipermail/vim/2007-August/001762.htmlmailing-list, x_refsource_VIM
http://sourceforge.net/tracker/index.php?func=detail&aid=1778696&group_id=189733&atid=930513x_refsource_CONFIRM
http://osvdb.org/39534vdb-entry, x_refsource_OSVDB
http://www.attrition.org/pipermail/vim/2007-August/001768.htmlmailing-list, x_refsource_VIM
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T14:53:55.373Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "3009",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/3009"
          },
          {
            "name": "20070813 Re: FCMS (Family Connections) \u003c= 0.1.1 Remote Command Execution Exploit // www.MefistoLabs.com",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/476293/100/0/threaded"
          },
          {
            "name": "20070811 FCMS (Family Connections) \u003c= 0.1.1 Remote Command Execution Exploit // www.MefistoLabs.com",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/476142/100/0/threaded"
          },
          {
            "name": "25276",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/25276"
          },
          {
            "name": "26421",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/26421"
          },
          {
            "name": "family-fcmsloginid-security-bypass(35966)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35966"
          },
          {
            "name": "20070814 uncertain: FCMS (Family Connections) code execution",
            "tags": [
              "mailing-list",
              "x_refsource_VIM",
              "x_transferred"
            ],
            "url": "http://www.attrition.org/pipermail/vim/2007-August/001762.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1778696\u0026group_id=189733\u0026atid=930513"
          },
          {
            "name": "39534",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/39534"
          },
          {
            "name": "20070823 vendor ACK for CVE-2007-4338 (Familr Connections)",
            "tags": [
              "mailing-list",
              "x_refsource_VIM",
              "x_transferred"
            ],
            "url": "http://www.attrition.org/pipermail/vim/2007-August/001768.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2007-08-11T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "index.php in Ryan Haudenschilt Family Connections (FCMS) before 0.9 allows remote attackers to access an arbitrary account by placing the account\u0027s name in the value of an fcms_login_id cookie.  NOTE: this can be leveraged for code execution via a POST with PHP code in the content parameter."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-15T20:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "3009",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/3009"
        },
        {
          "name": "20070813 Re: FCMS (Family Connections) \u003c= 0.1.1 Remote Command Execution Exploit // www.MefistoLabs.com",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/476293/100/0/threaded"
        },
        {
          "name": "20070811 FCMS (Family Connections) \u003c= 0.1.1 Remote Command Execution Exploit // www.MefistoLabs.com",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/476142/100/0/threaded"
        },
        {
          "name": "25276",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/25276"
        },
        {
          "name": "26421",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/26421"
        },
        {
          "name": "family-fcmsloginid-security-bypass(35966)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35966"
        },
        {
          "name": "20070814 uncertain: FCMS (Family Connections) code execution",
          "tags": [
            "mailing-list",
            "x_refsource_VIM"
          ],
          "url": "http://www.attrition.org/pipermail/vim/2007-August/001762.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1778696\u0026group_id=189733\u0026atid=930513"
        },
        {
          "name": "39534",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/39534"
        },
        {
          "name": "20070823 vendor ACK for CVE-2007-4338 (Familr Connections)",
          "tags": [
            "mailing-list",
            "x_refsource_VIM"
          ],
          "url": "http://www.attrition.org/pipermail/vim/2007-August/001768.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2007-4338",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "index.php in Ryan Haudenschilt Family Connections (FCMS) before 0.9 allows remote attackers to access an arbitrary account by placing the account\u0027s name in the value of an fcms_login_id cookie.  NOTE: this can be leveraged for code execution via a POST with PHP code in the content parameter."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "3009",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/3009"
            },
            {
              "name": "20070813 Re: FCMS (Family Connections) \u003c= 0.1.1 Remote Command Execution Exploit // www.MefistoLabs.com",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/476293/100/0/threaded"
            },
            {
              "name": "20070811 FCMS (Family Connections) \u003c= 0.1.1 Remote Command Execution Exploit // www.MefistoLabs.com",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/476142/100/0/threaded"
            },
            {
              "name": "25276",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/25276"
            },
            {
              "name": "26421",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/26421"
            },
            {
              "name": "family-fcmsloginid-security-bypass(35966)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35966"
            },
            {
              "name": "20070814 uncertain: FCMS (Family Connections) code execution",
              "refsource": "VIM",
              "url": "http://www.attrition.org/pipermail/vim/2007-August/001762.html"
            },
            {
              "name": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1778696\u0026group_id=189733\u0026atid=930513",
              "refsource": "CONFIRM",
              "url": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1778696\u0026group_id=189733\u0026atid=930513"
            },
            {
              "name": "39534",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/39534"
            },
            {
              "name": "20070823 vendor ACK for CVE-2007-4338 (Familr Connections)",
              "refsource": "VIM",
              "url": "http://www.attrition.org/pipermail/vim/2007-August/001768.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2007-4338",
    "datePublished": "2007-08-14T18:00:00",
    "dateReserved": "2007-08-14T00:00:00",
    "dateUpdated": "2024-08-07T14:53:55.373Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2011-5130 (GCVE-0-2011-5130)
Vulnerability from cvelistv5
Published
2012-08-30 22:00
Modified
2024-08-07 00:23
Severity ?
CWE
  • n/a
Summary
dev/less.php in Family Connections CMS (FCMS) 2.5.0 - 2.7.1, when register_globals is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in the argv[1] parameter.
References
http://secunia.com/advisories/47069third-party-advisory, x_refsource_SECUNIA
http://sourceforge.net/apps/trac/fam-connections/ticket/407x_refsource_CONFIRM
https://exchange.xforce.ibmcloud.com/vulnerabilities/71618vdb-entry, x_refsource_XF
http://www.exploit-db.com/exploits/18198exploit, x_refsource_EXPLOIT-DB
http://www.exploit-db.com/exploits/18208exploit, x_refsource_EXPLOIT-DB
https://www.familycms.com/blog/2011/11/security-vulnerability-fcms-2-5-2-7-1/x_refsource_CONFIRM
http://osvdb.org/77492vdb-entry, x_refsource_OSVDB
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T00:23:40.127Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "47069",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/47069"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://sourceforge.net/apps/trac/fam-connections/ticket/407"
          },
          {
            "name": "family-connections-less-command-exec(71618)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/71618"
          },
          {
            "name": "18198",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "http://www.exploit-db.com/exploits/18198"
          },
          {
            "name": "18208",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "http://www.exploit-db.com/exploits/18208"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.familycms.com/blog/2011/11/security-vulnerability-fcms-2-5-2-7-1/"
          },
          {
            "name": "77492",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/77492"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2011-11-29T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "dev/less.php in Family Connections CMS (FCMS) 2.5.0 - 2.7.1, when register_globals is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in the argv[1] parameter."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-28T12:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "47069",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/47069"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://sourceforge.net/apps/trac/fam-connections/ticket/407"
        },
        {
          "name": "family-connections-less-command-exec(71618)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/71618"
        },
        {
          "name": "18198",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "http://www.exploit-db.com/exploits/18198"
        },
        {
          "name": "18208",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "http://www.exploit-db.com/exploits/18208"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.familycms.com/blog/2011/11/security-vulnerability-fcms-2-5-2-7-1/"
        },
        {
          "name": "77492",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/77492"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2011-5130",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "dev/less.php in Family Connections CMS (FCMS) 2.5.0 - 2.7.1, when register_globals is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in the argv[1] parameter."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "47069",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/47069"
            },
            {
              "name": "http://sourceforge.net/apps/trac/fam-connections/ticket/407",
              "refsource": "CONFIRM",
              "url": "http://sourceforge.net/apps/trac/fam-connections/ticket/407"
            },
            {
              "name": "family-connections-less-command-exec(71618)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/71618"
            },
            {
              "name": "18198",
              "refsource": "EXPLOIT-DB",
              "url": "http://www.exploit-db.com/exploits/18198"
            },
            {
              "name": "18208",
              "refsource": "EXPLOIT-DB",
              "url": "http://www.exploit-db.com/exploits/18208"
            },
            {
              "name": "https://www.familycms.com/blog/2011/11/security-vulnerability-fcms-2-5-2-7-1/",
              "refsource": "CONFIRM",
              "url": "https://www.familycms.com/blog/2011/11/security-vulnerability-fcms-2-5-2-7-1/"
            },
            {
              "name": "77492",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/77492"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2011-5130",
    "datePublished": "2012-08-30T22:00:00",
    "dateReserved": "2012-08-30T00:00:00",
    "dateUpdated": "2024-08-07T00:23:40.127Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2009-2010 (GCVE-0-2009-2010)
Vulnerability from cvelistv5
Published
2009-06-08 19:00
Modified
2024-08-07 05:36
Severity ?
CWE
  • n/a
Summary
Multiple SQL injection vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 1.9 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) thread parameter to messageboard.php, (2) member parameter to profile.php, (3) pid parameter to gallery/index.php, and the (4) fcms_login_id cookie parameter.
References
http://secunia.com/advisories/35039third-party-advisory, x_refsource_SECUNIA
http://www.securityfocus.com/bid/34935vdb-entry, x_refsource_BID
https://www.exploit-db.com/exploits/8671exploit, x_refsource_EXPLOIT-DB
http://www.securityfocus.com/archive/1/503477/100/0/threadedmailing-list, x_refsource_BUGTRAQ
http://www.vupen.com/english/advisories/2009/1306vdb-entry, x_refsource_VUPEN
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T05:36:20.438Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "35039",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/35039"
          },
          {
            "name": "34935",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/34935"
          },
          {
            "name": "8671",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/8671"
          },
          {
            "name": "20090513 (GET var \u0027member\u0027) BLIND SQL INJECTION EXPLOIT --FAMILY CONNECTIONS \u003c= v1.9 --\u003e",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/503477/100/0/threaded"
          },
          {
            "name": "ADV-2009-1306",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/1306"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-05-13T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple SQL injection vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 1.9 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) thread parameter to messageboard.php, (2) member parameter to profile.php, (3) pid parameter to gallery/index.php, and the (4) fcms_login_id cookie parameter."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-10T18:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "35039",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/35039"
        },
        {
          "name": "34935",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/34935"
        },
        {
          "name": "8671",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/8671"
        },
        {
          "name": "20090513 (GET var \u0027member\u0027) BLIND SQL INJECTION EXPLOIT --FAMILY CONNECTIONS \u003c= v1.9 --\u003e",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/503477/100/0/threaded"
        },
        {
          "name": "ADV-2009-1306",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/1306"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2009-2010",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple SQL injection vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 1.9 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) thread parameter to messageboard.php, (2) member parameter to profile.php, (3) pid parameter to gallery/index.php, and the (4) fcms_login_id cookie parameter."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "35039",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/35039"
            },
            {
              "name": "34935",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/34935"
            },
            {
              "name": "8671",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/8671"
            },
            {
              "name": "20090513 (GET var \u0027member\u0027) BLIND SQL INJECTION EXPLOIT --FAMILY CONNECTIONS \u003c= v1.9 --\u003e",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/503477/100/0/threaded"
            },
            {
              "name": "ADV-2009-1306",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/1306"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2009-2010",
    "datePublished": "2009-06-08T19:00:00",
    "dateReserved": "2009-06-08T00:00:00",
    "dateUpdated": "2024-08-07T05:36:20.438Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2012-0699 (GCVE-0-2012-0699)
Vulnerability from cvelistv5
Published
2018-01-11 20:00
Modified
2024-08-06 18:30
Severity ?
CWE
  • n/a
Summary
Multiple cross-site request forgery (CSRF) vulnerabilities in Family Connections CMS (aka FCMS) 2.9 and earlier allow remote attackers to hijack the authentication of arbitrary users for requests that (1) add news via an add action to familynews.php or (2) add a prayer via an add action to prayers.php.
References
http://www.exploit-db.com/exploits/18667exploit, x_refsource_EXPLOIT-DB
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T18:30:53.999Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "18667",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "http://www.exploit-db.com/exploits/18667"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-03-26T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple cross-site request forgery (CSRF) vulnerabilities in Family Connections CMS (aka FCMS) 2.9 and earlier allow remote attackers to hijack the authentication of arbitrary users for requests that (1) add news via an add action to familynews.php or (2) add a prayer via an add action to prayers.php."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-01-11T19:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "18667",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "http://www.exploit-db.com/exploits/18667"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2012-0699",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple cross-site request forgery (CSRF) vulnerabilities in Family Connections CMS (aka FCMS) 2.9 and earlier allow remote attackers to hijack the authentication of arbitrary users for requests that (1) add news via an add action to familynews.php or (2) add a prayer via an add action to prayers.php."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "18667",
              "refsource": "EXPLOIT-DB",
              "url": "http://www.exploit-db.com/exploits/18667"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2012-0699",
    "datePublished": "2018-01-11T20:00:00",
    "dateReserved": "2012-01-14T00:00:00",
    "dateUpdated": "2024-08-06T18:30:53.999Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2008-2901 (GCVE-0-2008-2901)
Vulnerability from cvelistv5
Published
2008-06-30 18:00
Modified
2024-08-07 09:21
Severity ?
CWE
  • n/a
Summary
Multiple SQL injection vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 1.4 allow remote authenticated users to execute arbitrary SQL commands via the (1) address parameter to addressbook.php, the (2) getnews parameter to familynews.php, and the (3) poll_id parameter to home.php in a results action.
References
https://exchange.xforce.ibmcloud.com/vulnerabilities/43097vdb-entry, x_refsource_XF
http://secunia.com/advisories/30680third-party-advisory, x_refsource_SECUNIA
https://www.exploit-db.com/exploits/5811exploit, x_refsource_EXPLOIT-DB
http://www.securityfocus.com/bid/29722vdb-entry, x_refsource_BID
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T09:21:34.512Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "familyconnections-multiple-sql-injection(43097)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43097"
          },
          {
            "name": "30680",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/30680"
          },
          {
            "name": "5811",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/5811"
          },
          {
            "name": "29722",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/29722"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2008-06-14T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple SQL injection vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 1.4 allow remote authenticated users to execute arbitrary SQL commands via the (1) address parameter to addressbook.php, the (2) getnews parameter to familynews.php, and the (3) poll_id parameter to home.php in a results action."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-09-28T12:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "familyconnections-multiple-sql-injection(43097)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43097"
        },
        {
          "name": "30680",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/30680"
        },
        {
          "name": "5811",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/5811"
        },
        {
          "name": "29722",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/29722"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2008-2901",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple SQL injection vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 1.4 allow remote authenticated users to execute arbitrary SQL commands via the (1) address parameter to addressbook.php, the (2) getnews parameter to familynews.php, and the (3) poll_id parameter to home.php in a results action."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "familyconnections-multiple-sql-injection(43097)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43097"
            },
            {
              "name": "30680",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/30680"
            },
            {
              "name": "5811",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/5811"
            },
            {
              "name": "29722",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/29722"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2008-2901",
    "datePublished": "2008-06-30T18:00:00",
    "dateReserved": "2008-06-30T00:00:00",
    "dateUpdated": "2024-08-07T09:21:34.512Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2010-3419 (GCVE-0-2010-3419)
Vulnerability from cvelistv5
Published
2010-09-16 21:00
Modified
2024-08-07 03:11
Severity ?
CWE
  • n/a
Summary
Multiple PHP remote file inclusion vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 2.2.3 allow remote attackers to execute arbitrary PHP code via a URL in the current_user_id parameter to (1) familynews.php and (2) settings.php.
References
http://www.exploit-db.com/exploits/14965exploit, x_refsource_EXPLOIT-DB
http://packetstormsecurity.org/1009-exploits/fcms-rfi.txtx_refsource_MISC
https://exchange.xforce.ibmcloud.com/vulnerabilities/61722vdb-entry, x_refsource_XF
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T03:11:43.477Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "14965",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "http://www.exploit-db.com/exploits/14965"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.org/1009-exploits/fcms-rfi.txt"
          },
          {
            "name": "fcms-familynews-file-include(61722)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/61722"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2010-09-10T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple PHP remote file inclusion vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 2.2.3 allow remote attackers to execute arbitrary PHP code via a URL in the current_user_id parameter to (1) familynews.php and (2) settings.php."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-16T14:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "14965",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "http://www.exploit-db.com/exploits/14965"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.org/1009-exploits/fcms-rfi.txt"
        },
        {
          "name": "fcms-familynews-file-include(61722)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/61722"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2010-3419",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple PHP remote file inclusion vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 2.2.3 allow remote attackers to execute arbitrary PHP code via a URL in the current_user_id parameter to (1) familynews.php and (2) settings.php."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "14965",
              "refsource": "EXPLOIT-DB",
              "url": "http://www.exploit-db.com/exploits/14965"
            },
            {
              "name": "http://packetstormsecurity.org/1009-exploits/fcms-rfi.txt",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.org/1009-exploits/fcms-rfi.txt"
            },
            {
              "name": "fcms-familynews-file-include(61722)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/61722"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2010-3419",
    "datePublished": "2010-09-16T21:00:00",
    "dateReserved": "2010-09-16T00:00:00",
    "dateUpdated": "2024-08-07T03:11:43.477Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Vulnerability from fkie_nvd
Published
2008-06-30 18:24
Modified
2025-04-09 00:30
Severity ?
Summary
Multiple SQL injection vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 1.4 allow remote authenticated users to execute arbitrary SQL commands via the (1) address parameter to addressbook.php, the (2) getnews parameter to familynews.php, and the (3) poll_id parameter to home.php in a results action.
References
cve@mitre.orghttp://secunia.com/advisories/30680Vendor Advisory
cve@mitre.orghttp://www.securityfocus.com/bid/29722Exploit
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/43097
cve@mitre.orghttps://www.exploit-db.com/exploits/5811
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/30680Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/29722Exploit
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/43097
af854a3a-2127-422b-91ae-364da2661108https://www.exploit-db.com/exploits/5811
Impacted products
Vendor Product Version
haudenschilt family_connections_cms 1.4


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:haudenschilt:family_connections_cms:1.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "8C009F6D-C0CB-4CE9-9B0A-9532167FBAB5",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple SQL injection vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 1.4 allow remote authenticated users to execute arbitrary SQL commands via the (1) address parameter to addressbook.php, the (2) getnews parameter to familynews.php, and the (3) poll_id parameter to home.php in a results action."
    },
    {
      "lang": "es",
      "value": "M\u00faltiples vulnerabilidades de inyecci\u00f3n SQL en Haudenschilt Family Connections CMS (FCMS) 1.4 permiten a usuarios remotos autenticados ejecutar comandos SQL de su elecci\u00f3n a trav\u00e9s del (1) par\u00e1metro address de addressbook.php, el (2) par\u00e1metro getnews de familynews.php, y el (3) par\u00e1metro poll_id de home.php in en una acci\u00f3n results."
    }
  ],
  "id": "CVE-2008-2901",
  "lastModified": "2025-04-09T00:30:58.490",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": true,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2008-06-30T18:24:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/30680"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/29722"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43097"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.exploit-db.com/exploits/5811"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/30680"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/29722"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43097"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.exploit-db.com/exploits/5811"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2018-01-11 20:29
Modified
2024-11-21 01:35
Severity ?
8.8 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
Multiple cross-site request forgery (CSRF) vulnerabilities in Family Connections CMS (aka FCMS) 2.9 and earlier allow remote attackers to hijack the authentication of arbitrary users for requests that (1) add news via an add action to familynews.php or (2) add a prayer via an add action to prayers.php.
References
cve@mitre.orghttp://www.exploit-db.com/exploits/18667Exploit, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108http://www.exploit-db.com/exploits/18667Exploit, Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
haudenschilt family_connections_cms *


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:haudenschilt:family_connections_cms:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "830B6010-0760-46A7-934D-07D58D19F72E",
              "versionEndIncluding": "2.9.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple cross-site request forgery (CSRF) vulnerabilities in Family Connections CMS (aka FCMS) 2.9 and earlier allow remote attackers to hijack the authentication of arbitrary users for requests that (1) add news via an add action to familynews.php or (2) add a prayer via an add action to prayers.php."
    },
    {
      "lang": "es",
      "value": "M\u00faltiples vulnerabilidades de Cross-Site Request Forgery (CSRF) en Family Connections CMS (tambi\u00e9n conocido como FCMS), en versiones 2.9 y anteriores, permiten que atacantes remotos secuestren la autenticaci\u00f3n de usuarios arbitrarios para peticiones que (1) a\u00f1aden noticias mediante una acci\u00f3n add en familynews.php o (2) a\u00f1aden un prayer mediante una acci\u00f3n add en prayers.php."
    }
  ],
  "id": "CVE-2012-0699",
  "lastModified": "2024-11-21T01:35:34.003",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2018-01-11T20:29:00.207",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.exploit-db.com/exploits/18667"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.exploit-db.com/exploits/18667"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2012-08-30 22:55
Modified
2025-04-11 00:51
Severity ?
Summary
dev/less.php in Family Connections CMS (FCMS) 2.5.0 - 2.7.1, when register_globals is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in the argv[1] parameter.
References
cve@mitre.orghttp://osvdb.org/77492
cve@mitre.orghttp://secunia.com/advisories/47069Vendor Advisory
cve@mitre.orghttp://sourceforge.net/apps/trac/fam-connections/ticket/407Exploit
cve@mitre.orghttp://www.exploit-db.com/exploits/18198Exploit
cve@mitre.orghttp://www.exploit-db.com/exploits/18208Exploit
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/71618
cve@mitre.orghttps://www.familycms.com/blog/2011/11/security-vulnerability-fcms-2-5-2-7-1/Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/77492
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/47069Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://sourceforge.net/apps/trac/fam-connections/ticket/407Exploit
af854a3a-2127-422b-91ae-364da2661108http://www.exploit-db.com/exploits/18198Exploit
af854a3a-2127-422b-91ae-364da2661108http://www.exploit-db.com/exploits/18208Exploit
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/71618
af854a3a-2127-422b-91ae-364da2661108https://www.familycms.com/blog/2011/11/security-vulnerability-fcms-2-5-2-7-1/Vendor Advisory
Impacted products
Vendor Product Version
haudenschilt family_connections_cms 2.5.0
haudenschilt family_connections_cms 2.5.1
haudenschilt family_connections_cms 2.5.2
haudenschilt family_connections_cms 2.5.3
haudenschilt family_connections_cms 2.5.4
haudenschilt family_connections_cms 2.6.0
haudenschilt family_connections_cms 2.7.0
haudenschilt family_connections_cms 2.7.1


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:haudenschilt:family_connections_cms:2.5.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "DD3F6566-2950-4125-ADE2-A6D13B21D387",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:haudenschilt:family_connections_cms:2.5.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "8FFCC4C3-F8E6-4080-B37B-C864785D360C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:haudenschilt:family_connections_cms:2.5.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "2D17839D-561A-4CC3-9E61-D04546876352",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:haudenschilt:family_connections_cms:2.5.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "2D637995-835D-43D4-A59A-91D091EB787E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:haudenschilt:family_connections_cms:2.5.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "0254ABA9-7E2C-41C5-8655-97DC5429D4B5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:haudenschilt:family_connections_cms:2.6.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "1CE7AE8E-9E7E-4D06-ACCB-4DED2A3CA0AF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:haudenschilt:family_connections_cms:2.7.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "7CF8B74A-88C8-429C-AA38-B1E7EC35CE3D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:haudenschilt:family_connections_cms:2.7.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "2D1B2E73-D7D4-4665-BF5C-979AFD87553C",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "dev/less.php in Family Connections CMS (FCMS) 2.5.0 - 2.7.1, when register_globals is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in the argv[1] parameter."
    },
    {
      "lang": "es",
      "value": "dev/less.php en Family Connections CMS (FCMS) v2.5.0 - v2.7.1, cuando register_globals es habilitada, permite a atacantes remotos ejecutar comandos arbitrarios a trav\u00e9s de meta caracteres de consola en el par\u00e1metro argv[1]."
    }
  ],
  "id": "CVE-2011-5130",
  "lastModified": "2025-04-11T00:51:21.963",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2012-08-30T22:55:03.983",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/77492"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/47069"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://sourceforge.net/apps/trac/fam-connections/ticket/407"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.exploit-db.com/exploits/18198"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.exploit-db.com/exploits/18208"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/71618"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.familycms.com/blog/2011/11/security-vulnerability-fcms-2-5-2-7-1/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/77492"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/47069"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://sourceforge.net/apps/trac/fam-connections/ticket/407"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.exploit-db.com/exploits/18198"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.exploit-db.com/exploits/18208"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/71618"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.familycms.com/blog/2011/11/security-vulnerability-fcms-2-5-2-7-1/"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2007-08-14 18:17
Modified
2025-04-09 00:30
Severity ?
Summary
index.php in Ryan Haudenschilt Family Connections (FCMS) before 0.9 allows remote attackers to access an arbitrary account by placing the account's name in the value of an fcms_login_id cookie. NOTE: this can be leveraged for code execution via a POST with PHP code in the content parameter.
References
cve@mitre.orghttp://osvdb.org/39534
cve@mitre.orghttp://secunia.com/advisories/26421Vendor Advisory
cve@mitre.orghttp://securityreason.com/securityalert/3009
cve@mitre.orghttp://sourceforge.net/tracker/index.php?func=detail&aid=1778696&group_id=189733&atid=930513
cve@mitre.orghttp://www.attrition.org/pipermail/vim/2007-August/001762.html
cve@mitre.orghttp://www.attrition.org/pipermail/vim/2007-August/001768.html
cve@mitre.orghttp://www.securityfocus.com/archive/1/476142/100/0/threaded
cve@mitre.orghttp://www.securityfocus.com/archive/1/476293/100/0/threaded
cve@mitre.orghttp://www.securityfocus.com/bid/25276Exploit
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/35966
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/39534
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/26421Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://securityreason.com/securityalert/3009
af854a3a-2127-422b-91ae-364da2661108http://sourceforge.net/tracker/index.php?func=detail&aid=1778696&group_id=189733&atid=930513
af854a3a-2127-422b-91ae-364da2661108http://www.attrition.org/pipermail/vim/2007-August/001762.html
af854a3a-2127-422b-91ae-364da2661108http://www.attrition.org/pipermail/vim/2007-August/001768.html
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/476142/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/476293/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/25276Exploit
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/35966
Impacted products
Vendor Product Version
haudenschilt family_connections_cms *
haudenschilt family_connections_cms 0.1.1
haudenschilt family_connections_cms 0.1.2
haudenschilt family_connections_cms 0.5
haudenschilt family_connections_cms 0.6


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:haudenschilt:family_connections_cms:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "7404352F-25A7-472A-BE0C-F4B35EE29E9C",
              "versionEndIncluding": "0.8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:haudenschilt:family_connections_cms:0.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "4A3DC010-D142-4DEB-B425-04B8E10D9AEB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:haudenschilt:family_connections_cms:0.1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "505E59AC-08C9-4D13-8470-76191D73F6A8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:haudenschilt:family_connections_cms:0.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "CBA041C5-5FF4-46A8-9F1D-74025E742EAA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:haudenschilt:family_connections_cms:0.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "D025AEE2-75AF-4959-9E78-E9AB6E163664",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "index.php in Ryan Haudenschilt Family Connections (FCMS) before 0.9 allows remote attackers to access an arbitrary account by placing the account\u0027s name in the value of an fcms_login_id cookie.  NOTE: this can be leveraged for code execution via a POST with PHP code in the content parameter."
    },
    {
      "lang": "es",
      "value": "El archivo index.php en Ryan Haudenschilt Family Connections (FCMS) versiones anteriores a 0.9, permite a atacantes remotos acceder a una cuenta arbitraria mediante la colocaci\u00f3n del nombre de la cuenta en el valor de una cookie de fcms_login_id. NOTA: esto puede ser aprovechado para la ejecuci\u00f3n de c\u00f3digo por medio de un POST con c\u00f3digo PHP en el par\u00e1metro content."
    }
  ],
  "id": "CVE-2007-4338",
  "lastModified": "2025-04-09T00:30:58.490",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 10.0,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 10.0,
        "obtainAllPrivilege": true,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2007-08-14T18:17:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/39534"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/26421"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://securityreason.com/securityalert/3009"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1778696\u0026group_id=189733\u0026atid=930513"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.attrition.org/pipermail/vim/2007-August/001762.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.attrition.org/pipermail/vim/2007-August/001768.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/476142/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/476293/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/25276"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35966"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/39534"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/26421"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securityreason.com/securityalert/3009"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1778696\u0026group_id=189733\u0026atid=930513"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.attrition.org/pipermail/vim/2007-August/001762.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.attrition.org/pipermail/vim/2007-August/001768.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/476142/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/476293/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/25276"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35966"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2009-06-08 19:30
Modified
2025-04-09 00:30
Severity ?
Summary
Multiple SQL injection vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 1.9 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) thread parameter to messageboard.php, (2) member parameter to profile.php, (3) pid parameter to gallery/index.php, and the (4) fcms_login_id cookie parameter.
References
cve@mitre.orghttp://secunia.com/advisories/35039Vendor Advisory
cve@mitre.orghttp://www.securityfocus.com/archive/1/503477/100/0/threaded
cve@mitre.orghttp://www.securityfocus.com/bid/34935Exploit
cve@mitre.orghttp://www.vupen.com/english/advisories/2009/1306Vendor Advisory
cve@mitre.orghttps://www.exploit-db.com/exploits/8671
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/35039Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/503477/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/34935Exploit
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2009/1306Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.exploit-db.com/exploits/8671
Impacted products
Vendor Product Version
haudenschilt family_connections_cms *
haudenschilt family_connections_cms 0.1.1
haudenschilt family_connections_cms 0.1.2
haudenschilt family_connections_cms 0.5
haudenschilt family_connections_cms 0.6
haudenschilt family_connections_cms 0.8
haudenschilt family_connections_cms 0.9
haudenschilt family_connections_cms 1.4
haudenschilt family_connections_cms 1.8.1
haudenschilt family_connections_cms 1.8.2


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:haudenschilt:family_connections_cms:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9E3BC0B4-9DA5-49B3-BAE1-B05014167EC6",
              "versionEndIncluding": "1.9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:haudenschilt:family_connections_cms:0.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "4A3DC010-D142-4DEB-B425-04B8E10D9AEB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:haudenschilt:family_connections_cms:0.1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "505E59AC-08C9-4D13-8470-76191D73F6A8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:haudenschilt:family_connections_cms:0.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "CBA041C5-5FF4-46A8-9F1D-74025E742EAA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:haudenschilt:family_connections_cms:0.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "D025AEE2-75AF-4959-9E78-E9AB6E163664",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:haudenschilt:family_connections_cms:0.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "0F32130D-8C69-4E23-BC2D-985AF5D41E0B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:haudenschilt:family_connections_cms:0.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "E84E4E37-EAD0-4069-9A23-12941E8E3B8F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:haudenschilt:family_connections_cms:1.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "8C009F6D-C0CB-4CE9-9B0A-9532167FBAB5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:haudenschilt:family_connections_cms:1.8.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "C4790A62-6E63-4D9A-87FF-2D1020E7C7E5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:haudenschilt:family_connections_cms:1.8.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "B944B953-EA7F-4B7D-A8B7-6A7807851ACC",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple SQL injection vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 1.9 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) thread parameter to messageboard.php, (2) member parameter to profile.php, (3) pid parameter to gallery/index.php, and the (4) fcms_login_id cookie parameter."
    },
    {
      "lang": "es",
      "value": "M\u00faltiples vulnerabilidades de inyecci\u00f3n SQL en Haudenschilt Family Connections CMS (FCMS) v1.9 y anteriores, permite a usuarios autenticados ejecutar comandos SQL de su elecci\u00f3n a trav\u00e9s de los par\u00e1metros (1) \"thread\" a messageboard.php, (2) \"member\" a profile.php, (3) \"pid\" a gallery/index.php, y (4) \"fcms_login_id cookie\"."
    }
  ],
  "id": "CVE-2009-2010",
  "lastModified": "2025-04-09T00:30:58.490",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2009-06-08T19:30:00.483",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/35039"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/503477/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/34935"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2009/1306"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.exploit-db.com/exploits/8671"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/35039"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/503477/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/34935"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2009/1306"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.exploit-db.com/exploits/8671"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2010-09-16 22:00
Modified
2025-04-11 00:51
Severity ?
Summary
Multiple PHP remote file inclusion vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 2.2.3 allow remote attackers to execute arbitrary PHP code via a URL in the current_user_id parameter to (1) familynews.php and (2) settings.php.
References
cve@mitre.orghttp://packetstormsecurity.org/1009-exploits/fcms-rfi.txtExploit
cve@mitre.orghttp://www.exploit-db.com/exploits/14965Exploit
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/61722
af854a3a-2127-422b-91ae-364da2661108http://packetstormsecurity.org/1009-exploits/fcms-rfi.txtExploit
af854a3a-2127-422b-91ae-364da2661108http://www.exploit-db.com/exploits/14965Exploit
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/61722
Impacted products
Vendor Product Version
haudenschilt family_connections_cms 2.2.3


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:haudenschilt:family_connections_cms:2.2.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "16DF0224-7977-450E-949A-B000AC94DF13",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple PHP remote file inclusion vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 2.2.3 allow remote attackers to execute arbitrary PHP code via a URL in the current_user_id parameter to (1) familynews.php and (2) settings.php."
    },
    {
      "lang": "es",
      "value": "M\u00faltiples vulnerabilidades de inclusi\u00f3n remota de archivo PHP en Haudenschilt Family Connections CMS (FCMS) v2.2.3 permite a atacantes remotos ejecutar c\u00f3digo PHP a su elecci\u00f3n a trav\u00e9s de una URL en el par\u00e1metro current_user_id a (1) familynews.php y (2) settings.php."
    }
  ],
  "id": "CVE-2010-3419",
  "lastModified": "2025-04-11T00:51:21.963",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2010-09-16T22:00:02.703",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://packetstormsecurity.org/1009-exploits/fcms-rfi.txt"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.exploit-db.com/exploits/14965"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/61722"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://packetstormsecurity.org/1009-exploits/fcms-rfi.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.exploit-db.com/exploits/14965"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/61722"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}