CVE-2008-4711

SQL injection vulnerability in Joovili 3.0 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter to (1) view.blog.php, (2) view.event.php, (3) view.group.php, (4) view.music.php, (5) view.picture.php, and (6) view.video.php.

CVSS v2.0 6.8 MEDIUM

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://securityreason.com/securityalert/4486
http://www.securityfocus.com/bid/31444	Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/45486
https://www.exploit-db.com/exploits/6595

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:joovili:joovili::::::::
	cpe:2.3:a:joovili:joovili:2.1:::::::*
	cpe:2.3:a:joovili:joovili:3.0.6:::::::*

History

No history.

Information

Published : 2008-10-23 17:17

Updated : 2024-02-04 17:33

NVD link : CVE-2008-4711

Mitre link : CVE-2008-4711

CVE.ORG link : CVE-2008-4711

JSON object : View

Products Affected

joovili

joovili

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2008-4711", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}]}, "published": "2008-10-23T17:17:14.827", "references": [{"url": "http://securityreason.com/securityalert/4486", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/31444", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45486", "source": "cve@mitre.org"}, {"url": "https://www.exploit-db.com/exploits/6595", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "SQL injection vulnerability in Joovili 3.0 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter to (1) view.blog.php, (2) view.event.php, (3) view.group.php, (4) view.music.php, (5) view.picture.php, and (6) view.video.php."}, {"lang": "es", "value": "Vulnerabilidad de inyecci\u00f3n SQL en Joovili v3.0 y anteriores, cuando magic_quotes est\u00e1 deshabilitado, permite a atacantes remotos ejecutar comandos SQL de su elecci\u00f3n a trav\u00e9s de los par\u00e1metros (1) \"view.blog.php\", (2) \"view.event.php\", (3) \"view.group.php\", (4) \"view.music.php\", (5) \"view.picture.php\" y (6) view.video.php."}], "lastModified": "2017-09-29T01:32:18.507", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:joovili:joovili:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5D8F4D40-E534-4E1E-B75F-B064C5258D47", "versionEndIncluding": "3.0"}, {"criteria": "cpe:2.3:a:joovili:joovili:2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B27CAD2D-AC10-4FFD-90BA-20B92A1FB851"}, {"criteria": "cpe:2.3:a:joovili:joovili:3.0.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "62B9373D-3D79-427B-BF21-623ACECB3E95"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}