Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

Family Connections CMS lets logged-in users run database commands

CVE-2009-2010 · published 17 years ago
Summary

The Family Connections CMS versions up to 1.9 allow a user who has logged in to send specially crafted data that makes the system run its own database commands. This could let an attacker view, change, or delete information stored by the site. Update to the latest version or apply the vendor's security patch, and limit login access to trusted personnel.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
haudenschilt family_connections_cms <= 1.9
0.1.1
0.1.2
0.5
0.6
0.8
0.9
1.4
1.8.1
1.8.2
cpe:2.3:a:haudenschilt:family_connections_cms:*:*:*:*:*:*:*:*
Original advisory text
Multiple SQL injection vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 1.9 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) thread parameter ...
Multiple SQL injection vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 1.9 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) thread parameter to messageboard.php, (2) member parameter to profile.php, (3) pid parameter to gallery/index.php, and the (4) fcms_login_id cookie parameter.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
6.5 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published8 Jun 2009
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2009-2010 · NVD
Track software like this
Free during beta