CVE		CVE-2009-2734
Статус		UNKNOWN
Описание		SQL injection vulnerability in the get_employee function in classweekreport.inc in Achievo before 1.4.0 allows remote attackers to execute arbitrary SQL commands via the userid parameter (aka user_id variable) to dispatch.php.
Важность		High
CVSS score		7,5
CVSS vector		(AV:N/AC:L/Au:N/C:P/I:P/A:P)
Phase		ASSIGNED (16.10.2009)
NVD:		http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-2734
References		BID : 36660
		BUGTRAQ : 20091013 [BONSAI] SQL Injection in Achievo
		CONFIRM : http://www.achievo.org/download/releasenotes/1_4_0
		MISC : http://www.bonsai-sec.com/research/vulnerabilities...
		SECTRACK : 1023017
		SECUNIA : 37035
		XF : achievo-dispatch-sql-injection(53743)
SecurityVulns:		Cводка уязвимостей безопасности в Web-приложениях (PHP, ASP, JSP, CGI, Perl)