← Database

CVE-2009-4796

HIGH CVSS: 7.5 Published: 2010-04-22 Modified: 2026-06-16

Description

Multiple SQL injection vulnerabilities in the ExecuteQueries function in private/system/classes/listfactory.class.php in glFusion 1.1.2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) order and (2) direction parameters to search.php.

Affected Platforms

Glfusion Glfusion

Weakness Type

CWE-89

References