CVE-2009-0402
SQL injection vulnerability in client/new_account.php in Domain Technologie Control (DTC) before...
SQL injection vulnerability in client/new_account.php in Domain Technologie Control (DTC) before 0.29.16 allows remote attackers to execute arbitrary SQL commands via the (1) familyname, (2) christname, (3) company_name, (4) is_company, (5) email, (6) phone, (7) fax, (8) addr1, (9) addr2, (10) addr3, (11) zipcode, (12) city, (13) state, (14) country, and (15) vat_num parameters.
Exploit likelihood
What each source reports
NVD Score used
SQL injection vulnerability in client/new_account.php in Domain Technologie Control (DTC) before 0.29.16 allows remote attackers to execute arbitrary SQL commands via the (1) familyname, (2) christname, (3) company_name, (4) is_company, (5) email, (6) phone, (7) fax, (8) addr1, (9) addr2, (10) addr3, (11) zipcode, (12) city, (13) state, (14) country, and (15) vat_num parameters.
- Record
CVE-2009-0402- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-89
- Updated
- 2026-11-02
CVE List No score
SQL injection vulnerability in client/new_account.php in Domain Technologie Control (DTC) before 0.29.16 allows remote attackers to execute arbitrary SQL commands via the (1) familyname, (2) christname, (3) company_name, (4) is_company, (5) email, (6) phone, (7) fax, (8) addr1, (9) addr2, (10) addr3, (11) zipcode, (12) city, (13) state, (14) country, and (15) vat_num parameters.
- Record
CVE-2009-0402- Updated
- 2026-11-02
EUVDEUVD-2009-0406 No score
SQL injection vulnerability in client/new_account.php in Domain Technologie Control (DTC) before 0.29.16 allows remote attackers to execute arbitrary SQL commands via the (1) familyname, (2) christname, (3) company_name, (4) is_company, (5) email, (6) phone, (7) fax, (8) addr1, (9) addr2, (10) addr3, (11) zipcode, (12) city, (13) state, (14) country, and (15) vat_num parameters.
- Record
EUVD-2009-0406- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rg6c-jj5w-9pgp No score
SQL injection vulnerability in client/new_account.php in Domain Technologie Control (DTC) before...
SQL injection vulnerability in client/new_account.php in Domain Technologie Control (DTC) before 0.29.16 allows remote attackers to execute arbitrary SQL commands via the (1) familyname, (2) christname, (3) company_name, (4) is_company, (5) email, (6) phone, (7) fax, (8) addr1, (9) addr2, (10) addr3, (11) zipcode, (12) city, (13) state, (14) country, and (15) vat_num parameters.
- Record
GHSA-rg6c-jj5w-9pgp- Weakness
- CWE-89
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-0402 is a high vulnerability (CVSS 7.5) in Gplhost Domain Technologie Control, published February 3, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.40%, the 72nd percentile. No source names a fixed version.
References
securityfocus.com/bid/33496
exchange.xforce.ibmcloud.com/vulnerabilities/48292
freshmeat.net/projects/dtc?branch_id=22759&release_id=292973
osvdb.org/51631
secunia.com/advisories/33698
git.gplhost.com/gitweb?p=dtc.git%3Ba=commitdiff%3Bh=056e1d1849ff3aa183a410e2aab1c1c3e969247d
nvd.nist.gov/vuln/detail/CVE-2009-0402
github.com/advisories/GHSA-rg6c-jj5w-9pgp