Vulnerability CVE-2008-6274
Published: 2009-02-25   Modified: 2012-02-12

Description:
Multiple SQL injection vulnerabilities in index.php in FamilyProject 2.0 allow remote attackers to execute arbitrary SQL commands via (1) the logmbr parameter (aka login field) or (2) the mdpmbr parameter (aka pass or "Mot de passe" field). NOTE: some of these details are obtained from third party information.

See advisories in our WLB2 database:
Topic
Author
Date
Low
Family Project 2.x (Auth Bypass) SQL Injection Vulnerability
The_5p3ctrum
28.02.2009

Type:

CWE-89

 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))

CVSS2 => (AV:N/AC:M/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
6.8/10
6.4/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
Mjcreation -> Familyproject 

 References:
http://www.milw0rm.com/exploits/7248
http://www.securityfocus.com/bid/32501
https://exchange.xforce.ibmcloud.com/vulnerabilities/46929
Copyright 2024, cxsecurity.com

 

Back to Top