CVE-2009-3040

CVE-2009-3040 details multiple SQL injection vulnerabilities in Open Computer and Software (OCS) Inventory NG version 1.02 for Unix. Attackers can exploit these flaws by injecting malicious SQL commands into the N, DL, O, and V parameters of download.php, and the SYSTEMID parameter of group_show.php. This vulnerability carries a CVSS score of 7.5, indicating high severity, as it allows remote attackers to execute arbitrary SQL commands without authentication, potentially leading to data compromise, modification, or denial of service. While there is no evidence of active exploitation or Metasploit/Nuclei modules, an ExploitDB entry (EDB-8836) confirms the existence of exploit code, though community discussion and media coverage are minimal.