CVE-2008-6622

SQL injection vulnerability in choosecard.php in WEBBDOMAIN Post Card (aka Web Postcards) 1.02, 1.01, and earlier allows remote attackers to execute arbitrary SQL commands via the catid parameter.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://osvdb.org/49823	Exploit
http://secunia.com/advisories/32494	Vendor Advisory
http://www.securityfocus.com/bid/32097	Exploit
https://www.exploit-db.com/exploits/6977
http://osvdb.org/49823	Exploit
http://secunia.com/advisories/32494	Vendor Advisory
http://www.securityfocus.com/bid/32097	Exploit
https://www.exploit-db.com/exploits/6977

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:webbdomian:post_card::::::::
	cpe:2.3:a:webbdomian:post_card:1.01:::::::*

History

21 Nov 2024, 00:57

Type	Values Removed	Values Added
References	~~() http://osvdb.org/49823 - Exploit~~	() http://osvdb.org/49823 - Exploit
References	~~() http://secunia.com/advisories/32494 - Vendor Advisory~~	() http://secunia.com/advisories/32494 - Vendor Advisory
References	~~() http://www.securityfocus.com/bid/32097 - Exploit~~	() http://www.securityfocus.com/bid/32097 - Exploit
References	~~() https://www.exploit-db.com/exploits/6977 -~~	() https://www.exploit-db.com/exploits/6977 -

Information

Published : 2009-04-06 21:30

Updated : 2024-11-21 00:57

NVD link : CVE-2008-6622

Mitre link : CVE-2008-6622

CVE.ORG link : CVE-2008-6622

JSON object : View

Products Affected

webbdomian

post_card

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2008-6622", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2009-04-06T21:30:00.203", "references": [{"url": "http://osvdb.org/49823", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/32494", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/32097", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "https://www.exploit-db.com/exploits/6977", "source": "cve@mitre.org"}, {"url": "http://osvdb.org/49823", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://secunia.com/advisories/32494", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/32097", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.exploit-db.com/exploits/6977", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "SQL injection vulnerability in choosecard.php in WEBBDOMAIN Post Card (aka Web Postcards) 1.02, 1.01, and earlier allows remote attackers to execute arbitrary SQL commands via the catid parameter."}, {"lang": "es", "value": "Vulnerabilidad de inyecci\u00f3n SQL en choosecard.php de WEBBDOMAIN Post Card (Web Postcards) v1.02 y v1.01 y anteriores. Permite a usuarios remotos ejecutar comandos SQL de su elecci\u00f3n a trav\u00e9s del par\u00e1metro catid."}], "lastModified": "2024-11-21T00:57:01.323", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:webbdomian:post_card:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B26A0B66-7642-4CD9-A04D-9C19C2B43608", "versionEndIncluding": "1.02"}, {"criteria": "cpe:2.3:a:webbdomian:post_card:1.01:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "97F048B8-865C-4A01-A0E3-18C394A4C716"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}