PT-2008-4703 · Webligo Developments · Socialengine

Tim Loshak · Published 2008-07-25 · Updated 2018-10-11 · CVE-2008-3297

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: SocialEngine versions prior to 2.83

Description: The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via an se user cookie to the "include/class user.php" endpoint or an se admin cookie to the "include/class admin.php" endpoint.

Recommendations: For versions prior to 2.83, update to version 2.83 or later to resolve the issue. As a temporary workaround, consider restricting access to the include/class user.php and include/class admin.php endpoints until the update is applied. Avoid using the se user and se admin cookies in these endpoints until the issue is resolved.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2008-3297

Affected Products

Socialengine

References · 7

• http://secunia.com/advisories/31203 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-3297 · Security Note
• http://socialengine.net/news.php · Patch
• http://securityfocus.com/bid/30342 · Note
• http://securityfocus.com/archive/1/494638/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43958 · Note
• http://securityreason.com/securityalert/4035 · Note