CVE-2008-3788

Multiple SQL injection vulnerabilities in PICTURESPRO Photo Cart 3.9, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) qtitle, (2) qid, and (3) qyear parameters to (a) search.php, and the (4) email and (5) password parameters to (b) _login.php.

CVSS v2.0 6.8 MEDIUM

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://packetstormsecurity.org/0808-exploits/photocart-sql.txt	Exploit
http://securityreason.com/securityalert/4188
http://www.securityfocus.com/bid/30786	Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/44607
https://www.exploit-db.com/exploits/6285

Configurations

Configuration 1 (hide)

cpe:2.3:a:picturespro:picturespro_photo_cart:3.9:*:*:*:*:*:*:*

History

No history.

Information

Published : 2008-08-26 14:41

Updated : 2024-02-28 11:21

NVD link : CVE-2008-3788

Mitre link : CVE-2008-3788

CVE.ORG link : CVE-2008-3788

JSON object : View

Products Affected

picturespro

picturespro_photo_cart

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2008-3788", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}]}, "published": "2008-08-26T14:41:00.000", "references": [{"url": "http://packetstormsecurity.org/0808-exploits/photocart-sql.txt", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://securityreason.com/securityalert/4188", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/30786", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44607", "source": "cve@mitre.org"}, {"url": "https://www.exploit-db.com/exploits/6285", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "Multiple SQL injection vulnerabilities in PICTURESPRO Photo Cart 3.9, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) qtitle, (2) qid, and (3) qyear parameters to (a) search.php, and the (4) email and (5) password parameters to (b) _login.php."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de inyecci\u00f3n SQL en PICTURESPRO Photo Cart 3.9 cuando magic_quotes_gpc est\u00e1 deshabilitado, permiten a atacantes remotos ejecutar comandos SQL de su elecci\u00f3n mediante los par\u00e1metros (1) qtitle, (2) qid y (3) qyear de (a) search.php, y los par\u00e1metros (4) email y (5) password de (b) _login.php."}], "lastModified": "2017-09-29T01:31:51.210", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:picturespro:picturespro_photo_cart:3.9:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5C34D5F0-620F-4AF2-A8E5-A855E7E3180D"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}