CVE-2009-2385

no score yetEPSS 1.0%

SQL injection vulnerability in the awardsMembers function in Sources/Profile.php in the Member Awards component 1.0.2 for Simple Machines Forum (SMF) allows remote attackers to execute arbitrary SQL commands via the id parameter in a profile action to index.php. NOTE: some of these details are obtained from third party information.

EPSS: 1.0% chance of exploitation in the next 30 days; higher than 61% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2009-07-08
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

fustrate:member_awards

References

http://secunia.com/advisories/35661
http://www.exploit-db.com/exploits/9050
http://www.securityfocus.com/bid/35536
https://exchange.xforce.ibmcloud.com/vulnerabilities/51441
http://secunia.com/advisories/35661

Check your stack JSON