CVE-2009-2010

Severity: medium (CVSS 6.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2009-06-08 · updated 2026-06-16
Weakness: CWE-89

Description

Multiple SQL injection vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 1.9 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) thread parameter to messageboard.php, (2) member parameter to profile.php, (3) pid parameter to gallery/index.php, and the (4) fcms_login_id cookie parameter.

Affected products

Haudenschilt Family Connections Cms: through 1.9; 0.1.1, 0.1.2, 0.5, 0.6, 0.8, 0.9 (+3)

References

http://secunia.com/advisories/35039
http://www.securityfocus.com/archive/1/503477/100/0/threaded
http://www.securityfocus.com/bid/34935
http://www.vupen.com/english/advisories/2009/1306
https://www.exploit-db.com/exploits/8671
http://secunia.com/advisories/35039
http://www.securityfocus.com/archive/1/503477/100/0/threaded
http://www.securityfocus.com/bid/34935
http://www.vupen.com/english/advisories/2009/1306
https://www.exploit-db.com/exploits/8671

Get alerted when CVE-2009-2010 or the next vulnerability affects your stack