PT-2008-5866 · Xoops · Makale

Echoll · Published 2008-10-21 · Updated 2017-09-29 · CVE-2008-4653

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Makale versions 0.26 and possibly other versions

Description The issue allows remote attackers to execute arbitrary SQL commands via the id parameter in the makale.php file, a module for XOOPS.

Recommendations For Makale version 0.26, update the module to prevent SQL injection attacks by properly sanitizing the id parameter. For other possibly affected versions, ensure that the id parameter is validated and sanitized to prevent arbitrary SQL command execution.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2008-4653

Affected Products

Makale

References · 6

• 🔥 http://securityfocus.com/bid/31834 · Exploit
• 🔥 https://exploit-db.com/exploits/6795 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-4653 · Security Note
• http://secunia.com/advisories/32347 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45991 · Note
• http://securityreason.com/securityalert/4459 · Note