Vulnerability CVE-2008-1496
Published: 2008-03-25   Modified: 2012-02-12

Description:
Multiple SQL injection vulnerabilities in PEEL, possibly 3.x and earlier, allow remote attackers to execute arbitrary SQL commands via the (1) email parameter to (a) membre.php, and the (2) timestamp parameter to (b) the details action in achat/historique_commandes.php and (c) the facture action in factures/facture_html.php.

Type:

CWE-89

 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
7.5/10
6.4/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
PEEL -> PEEL 

 References:
http://xforce.iss.net/xforce/xfdb/41353
http://xforce.iss.net/xforce/xfdb/41341
http://www.securityfocus.com/bid/28346
http://www.milw0rm.com/exploits/5281
http://secunia.com/advisories/29466
http://realn.free.fr/releases/70207
Copyright 2024, cxsecurity.com

 

Back to Top