CVE-2008-1895

Multiple SQL injection vulnerabilities in Carbon Communities 2.4 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) ID parameter to events.asp, the (2) UserName parameter to getpassword.asp, and possibly an unspecified parameter to (3) option_Update.asp in an edit action.

CVSS v2.0

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

1.19% chance of exploitation in the next 30 days, 66th percentile

Published

2008-04-18

Updated

2024-08-07

Proof-of-concept exploits (1)

• http://bugreport.ir/index.php?/35/exploit

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/5456

References

• CVE Record
• NVD entry

Related

• CVE-2008-1893
• CVE-2008-1896
• CVE-2008-1889
• CVE-2008-1898
• CVE-2008-1888
• CVE-2008-1903