{"id":"CVE-2009-3040","details":"Multiple SQL injection vulnerabilities in Open Computer and Software (OCS) Inventory NG 1.02 for Unix allow remote attackers to execute arbitrary SQL commands via the (1) N, (2) DL, (3) O and (4) V parameters to download.php and the (5) SYSTEMID parameter to group_show.php.","modified":"2026-04-10T03:40:53.383673Z","published":"2009-09-01T18:30:03Z","references":[{"type":"EVIDENCE","url":"http://www.leidecker.info/advisories/2009-05-30-ocs_inventory_ng_sql_injection.shtml"},{"type":"WEB","url":"http://www.ocsinventory-ng.org/index.php?mact=News%2Ccntnt01%2Cdetail%2C0&cntnt01articleid=140&cntnt01returnid=72"},{"type":"WEB","url":"http://www.securityfocus.com/archive/1/503936/100/0/threaded"}],"schema_version":"1.7.5"}