ByteOS Network

NVD Vulnerability Details :

CVE-2008-3649

Modified

Source-cve@mitre.org

Published At-13 Aug, 2008 | 00:41

Updated At-29 Sep, 2017 | 01:31

SQL injection vulnerability in categorydetail.php in Article Friendly Standard allows remote attackers to execute arbitrary SQL commands via the Cat parameter.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	2.0	6.8	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:P

CPE Matches

articlefriendly>>article_friendly>>*

cpe:2.3:a:articlefriendly:article_friendly:*:*:standard:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-89	Primary	nvd@nist.gov

Evaluator Impact

Regarding Access Complexity: http://secunia.com/advisories/31292: "Input passed to the "autid" parameter in authordetail.php and to the "Cat" parameter in categorydetail.php is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. Successful exploitation requires that "magic_quotes_gpc" is disabled."

References

Hyperlink	Source	Resource
http://secunia.com/advisories/31292	cve@mitre.org	Vendor Advisory
http://securityreason.com/securityalert/4149	cve@mitre.org	N/A
http://www.securityfocus.com/bid/30453	cve@mitre.org	N/A
http://www.vupen.com/english/advisories/2008/2254	cve@mitre.org	N/A
https://exchange.xforce.ibmcloud.com/vulnerabilities/44121	cve@mitre.org	N/A
https://www.exploit-db.com/exploits/6167	cve@mitre.org	N/A

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History