ByteOS Network

NVD Vulnerability Details :

CVE-2008-4338

Modified

Source-cve@mitre.org

Published At-30 Sep, 2008 | 17:22

Updated At-11 Oct, 2018 | 20:51

SQL injection vulnerability in the brilliant_gallery_checklist_save function in the bgchecklist/save script in Brilliant Gallery 5.x and 6.x, a module for Drupal, allows remote authenticated users with "access brilliant_gallery" permissions to execute arbitrary SQL commands via the (1) nid, (2) qid, (3) state, and possibly (4) user parameters.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	2.0	6.0	MEDIUM	AV:N/AC:M/Au:S/C:P/I:P/A:P

CPE Matches

vacilanda>>brilliant_gallery>>*

cpe:2.3:a:vacilanda:brilliant_gallery:*:*:*:*:*:*:*:*

vacilanda>>brilliant_gallery>>5

cpe:2.3:a:vacilanda:brilliant_gallery:5:*:*:*:*:*:*:*

vacilanda>>brilliant_gallery>>6

cpe:2.3:a:vacilanda:brilliant_gallery:6:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-89	Primary	nvd@nist.gov

References

Hyperlink	Source	Resource
http://drupal.org/node/313054	cve@mitre.org	N/A
http://lists.grok.org.uk/pipermail/full-disclosure/2008-September/064662.html	cve@mitre.org	Exploit
http://secunia.com/advisories/32015	cve@mitre.org	Vendor Advisory
http://securityreason.com/securityalert/4338	cve@mitre.org	N/A
http://www.securityfocus.com/archive/1/496726/100/0/threaded	cve@mitre.org	N/A
http://www.securityfocus.com/bid/31387	cve@mitre.org	Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/45411	cve@mitre.org	N/A

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History