PT-2008-3267 · Knowledgequest · Knowledgequest

Hadihadi · Published 2008-04-11 · Updated 2017-09-29 · CVE-2008-1726

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions KnowledgeQuest version 2.6

Description The issue allows remote attackers to execute arbitrary SQL commands due to multiple SQL injection vulnerabilities. This is possible when the magic quotes gpc setting is disabled. The vulnerabilities can be exploited through specific parameters in various PHP files, including the kqid parameter in "articletext.php" and "articletextonly.php", and the username parameter in "logincheck.php".

Recommendations For KnowledgeQuest version 2.6, consider disabling the kqid parameter in "articletext.php" and "articletextonly.php" and the username parameter in "logincheck.php" until a patch is available. Additionally, enabling the magic quotes gpc setting can help mitigate the risk of SQL injection attacks.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2008-1726

Affected Products

Knowledgequest

References · 9

• 🔥 https://exploit-db.com/exploits/5421 · Exploit
• 🔥 http://securityfocus.com/bid/28713 · Exploit
• 🔥 http://securityfocus.com/bid/28716 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-1726 · Security Note
• http://secunia.com/advisories/29716 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41746 · Note
• http://osvdb.org/44255 · Note
• http://osvdb.org/44256 · Note
• http://osvdb.org/44254 · Note