CVE-2008-2862

Multiple SQL injection vulnerabilities in eLineStudio Site Composer (ESC) 2.6 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to ansFAQ.asp and the (2) template_id parameter to preview.asp.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://osvdb.org/46461
http://secunia.com/advisories/30762	Vendor Advisory
http://securityreason.com/securityalert/3957
http://www.bugreport.ir/?/45	Exploit
http://www.securityfocus.com/archive/1/493473/100/0/threaded
http://www.securityfocus.com/bid/29812	Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/43190
https://www.exploit-db.com/exploits/5859

Configurations

Configuration 1 (hide)

cpe:2.3:a:elinestudio:site_composer:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2008-06-25 12:36

Updated : 2023-12-10 10:51

NVD link : CVE-2008-2862

Mitre link : CVE-2008-2862

CVE.ORG link : CVE-2008-2862

JSON object : View

Products Affected

elinestudio

site_composer

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2008-2862", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}]}, "published": "2008-06-25T12:36:00.000", "references": [{"url": "http://osvdb.org/46461", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/30762", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://securityreason.com/securityalert/3957", "source": "cve@mitre.org"}, {"url": "http://www.bugreport.ir/?/45", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/493473/100/0/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/29812", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43190", "source": "cve@mitre.org"}, {"url": "https://www.exploit-db.com/exploits/5859", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "Multiple SQL injection vulnerabilities in eLineStudio Site Composer (ESC) 2.6 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to ansFAQ.asp and the (2) template_id parameter to preview.asp."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de inyecci\u00f3n SQL en eLineStudio Site Composer (ESC) 2.6 y anteriores, permite a atacantes remotos ejecutar comandos SQL de su elecci\u00f3n a trav\u00e9s de los par\u00e1metros (1) id al ansFAQ.asp y (2) template_id a preview.asp."}], "lastModified": "2018-10-11T20:44:50.683", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:elinestudio:site_composer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F0FD8D51-A4F6-464D-93E3-1EA6C2C50A45", "versionEndIncluding": "2.6"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}