CVE-2008-5888

Multiple SQL injection vulnerabilities in Click&Rank allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) hitcounter.asp, (2) user_delete.asp, and (3) user_update.asp; (4) the userid parameter to admin_login.asp (aka the USERNAME field in admin.asp); and (5) the PassWord parameter to admin_login.asp (aka the PASSWORD field in admin.asp). NOTE: some of these details are obtained from third party information.

CVSS v2.0

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

0.97% chance of exploitation in the next 30 days, 60th percentile

Published

2009-01-12

Updated

2024-08-07

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/7486

References

• CVE Record
• NVD entry

Related

• CVE-2008-5886
• CVE-2008-5889
• CVE-2008-5885
• CVE-2008-5890
• CVE-2008-5884
• CVE-2008-5891