{"id":"CVE-2009-4577","title":"SQL injection vulnerability in the MDForum module 2.x through 2.07 for MAXdev MDPro allows remote attackers to execute arbitrary SQL command","published":"2010-01-06T18:00:09.057Z","updated":"2026-06-16T19:13:55.730Z","severity":"high","cvssScore":7.5,"epss":0.01173,"epssPct":0.67921,"kev":false,"maturity":"none","actionScore":30,"primaryVendor":"maxdev","primaryProduct":"mdpro","cweId":"CWE-89","fixAvailable":false,"tags":["pre-auth","rce","sqli","remote"],"epssDelta7":0,"summary":"SQL injection vulnerability in the MDForum module 2.x through 2.07 for MAXdev MDPro allows remote attackers to execute arbitrary SQL commands via the c parameter to index.php.","cvssVector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","cvssVersion":"2.0","cvssSource":"nvd-primary","cweName":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","kevAdded":null,"kevDue":null,"kevRansomware":null,"source":"nvd","cna":"mitre","ssvc":null,"sources":{"cna":"2024-08-07T07:08:37.991Z","epss":"2026-11-12","cna_seen":"2026-09-29T10:45:31.492Z"},"cvssCna":null,"hasPatchRef":false,"credits":[],"counts":{"exploitdb":0,"metasploit":0,"nuclei":0,"githubPoc":0},"products":[{"vendor":"maxdev","product":"mdpro","cpe":"cpe:2.3:a:maxdev:mdpro"},{"vendor":"maxdev","product":"mdforum","cpe":"cpe:2.3:a:maxdev:mdforum"}],"references":[{"url":"http://secunia.com/advisories/37748","tags":"Vendor Advisory"},{"url":"http://www.osvdb.org/61347","tags":null},{"url":"http://www.securityfocus.com/bid/37488","tags":null},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/55138","tags":null}],"exploits":[],"analysis":null,"affectedVersions":[{"vendor":"maxdev","product":"mdforum","version":"2.0.1","vsi":null,"vse":null,"vei":null,"vee":null}],"source_attribution":"NVD (NIST), CVE Program, CISA KEV, FIRST EPSS, OSV. Aggregated by Noroxi."}