{
  "modified": "2025-04-09T00:30:58Z",
  "published": "2009-09-01T18:30:03Z",
  "id": "CVE-2009-3040",
  "details": "Multiple SQL injection vulnerabilities in Open Computer and Software (OCS) Inventory NG 1.02 for Unix allow remote attackers to execute arbitrary SQL commands via the (1) N, (2) DL, (3) O and (4) V parameters to download.php and the (5) SYSTEMID parameter to group_show.php.",
  "references": [
    {
      "type": "EVIDENCE",
      "url": "http://www.leidecker.info/advisories/2009-05-30-ocs_inventory_ng_sql_injection.shtml"
    },
    {
      "type": "WEB",
      "url": "http://www.ocsinventory-ng.org/index.php?mact=News%2Ccntnt01%2Cdetail%2C0\u0026cntnt01articleid=140\u0026cntnt01returnid=72"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/503936/100/0/threaded"
    }
  ]
}