CVE-2009-0728

SQL injection vulnerability in the My_eGallery module for MAXdev MDPro (MD-Pro) and Postnuke allows remote attackers to execute arbitrary SQL commands via the pid parameter in a showpic action to index.php.

Affected products

Maxdev Md-Pro, Postnuke

Maxdev My Egallery

All versions

CVSS 2.0

7.5 HIGH

EPSS

0.9% (58th percentile)

Weakness

CWE-89

NVD status

Modified

Published

2009-02-24