CVE-2008-6225

SQL injection vulnerability in info.php in Mole Group Airline Ticket Sale Script allows remote attackers to execute arbitrary SQL commands via the flight parameter. NOTE: the vendor has disputed this issue, stating "crazy hackers and so named Security companies [spread] out such false informations. Such scripts or versions [do not] exist.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://osvdb.org/49694
http://secunia.com/advisories/32577	Vendor Advisory
http://www.mole-group.com/content/view/57/72
http://www.securityfocus.com/bid/32138
http://www.vupen.com/english/advisories/2008/3027
https://exchange.xforce.ibmcloud.com/vulnerabilities/46383
https://www.exploit-db.com/exploits/7009

Configurations

Configuration 1 (hide)

cpe:2.3:a:mole-group:airline_ticket_sale_script:-:*:*:*:*:*:*:*

History

07 Nov 2023, 02:03

Type	Values Removed	Values Added
Summary	DISPUTED SQL injection vulnerability in info.php in Mole Group Airline Ticket Sale Script allows remote attackers to execute arbitrary SQL commands via the flight parameter. NOTE: the vendor has disputed this issue, stating "crazy hackers and so named Security companies [spread] out such false informations. Such scripts or versions [do not] exist."	SQL injection vulnerability in info.php in Mole Group Airline Ticket Sale Script allows remote attackers to execute arbitrary SQL commands via the flight parameter. NOTE: the vendor has disputed this issue, stating "crazy hackers and so named Security companies [spread] out such false informations. Such scripts or versions [do not] exist.

Information

Published : 2009-02-20 23:30

Updated : 2024-08-07 12:15

NVD link : CVE-2008-6225

Mitre link : CVE-2008-6225

CVE.ORG link : CVE-2008-6225

JSON object : View

Products Affected

mole-group

airline_ticket_sale_script

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2008-6225", "cveTags": [{"tags": ["disputed"], "sourceIdentifier": "cve@mitre.org"}], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2009-02-20T23:30:00.377", "references": [{"url": "http://osvdb.org/49694", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/32577", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.mole-group.com/content/view/57/72", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/32138", "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2008/3027", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46383", "source": "cve@mitre.org"}, {"url": "https://www.exploit-db.com/exploits/7009", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "SQL injection vulnerability in info.php in Mole Group Airline Ticket Sale Script allows remote attackers to execute arbitrary SQL commands via the flight parameter. NOTE: the vendor has disputed this issue, stating \"crazy hackers and so named Security companies [spread] out such false informations. Such scripts or versions [do not] exist."}, {"lang": "es", "value": "*** DISCUTIDA *** Vulnerabilidad de inyeccion SQL en info.php en la secuencia de comandos Mole Group Airline Ticket Sale permite a atacantes remotos ejecutar comandos SQL a su eleccion, a traves del parametro \"flight\". NOTA: El vendedor ha recurrido esta vulnerabilidad, afirmando \"piratas informaticos locos y autonombradas compa\u00f1ias de seguridad distribuyen esas falsas informaciones respecto a las secuencias de comandos o versiones que no existen\"."}], "lastModified": "2024-08-07T12:15:23.917", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mole-group:airline_ticket_sale_script:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6CDD01A3-11F2-472A-AB25-77E4ADF9C571"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}