CVE-2009-4437

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2009-12-28 · updated 2026-06-16
Weakness: CWE-89

Description

Multiple SQL injection vulnerabilities in Active Auction House 3.6 allow remote attackers to execute arbitrary SQL commands via the (1) catid parameter to wishlist.asp and the (2) linkid parameter to links.asp. NOTE: vector 1 might overlap CVE-2005-1029.1.

Affected products

Activewebsoftwares Active Auction House: 3.6

References

http://packetstormsecurity.org/0912-exploits/activeauctionhouse-sql.txt
http://secunia.com/advisories/14839
http://www.exploit-db.com/exploits/10520
http://www.securityfocus.com/bid/37401
https://exchange.xforce.ibmcloud.com/vulnerabilities/54891
http://packetstormsecurity.org/0912-exploits/activeauctionhouse-sql.txt
http://secunia.com/advisories/14839
http://www.exploit-db.com/exploits/10520
http://www.securityfocus.com/bid/37401
https://exchange.xforce.ibmcloud.com/vulnerabilities/54891

Get alerted when CVE-2009-4437 or the next vulnerability affects your stack