CVE-2008-2862

Multiple SQL injection vulnerabilities in eLineStudio Site Composer (ESC) 2.6 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to ansFAQ.asp and the (2) template_id parameter to preview.asp.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.bugreport.ir/?/45	Exploit
http://www.securityfocus.com/bid/29812	Exploit
http://secunia.com/advisories/30762	Vendor Advisory
http://securityreason.com/securityalert/3957
http://osvdb.org/46461
https://exchange.xforce.ibmcloud.com/vulnerabilities/43190
https://www.exploit-db.com/exploits/5859
http://www.securityfocus.com/archive/1/493473/100/0/threaded

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:a:elinestudio:site_composer:*:*:*:*:*:*:*:*

Information

Published : 2008-06-25 05:36

Updated : 2018-10-11 13:44

NVD link : CVE-2008-2862

Mitre link : CVE-2008-2862

JSON object : View

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Advertisement

Products Affected

elinestudio

site_composer

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.bugreport.ir/?/45", "name": "http://www.bugreport.ir/?/45", "tags": ["Exploit"], "refsource": "MISC"}, {"url": "http://www.securityfocus.com/bid/29812", "name": "29812", "tags": ["Exploit"], "refsource": "BID"}, {"url": "http://secunia.com/advisories/30762", "name": "30762", "tags": ["Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://securityreason.com/securityalert/3957", "name": "3957", "tags": [], "refsource": "SREASON"}, {"url": "http://osvdb.org/46461", "name": "46461", "tags": [], "refsource": "OSVDB"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43190", "name": "esc-ansfaq-preview-sql-injection(43190)", "tags": [], "refsource": "XF"}, {"url": "https://www.exploit-db.com/exploits/5859", "name": "5859", "tags": [], "refsource": "EXPLOIT-DB"}, {"url": "http://www.securityfocus.com/archive/1/493473/100/0/threaded", "name": "20080619 eLineStudio Site Composer (ESC) <=2.6 Multiple Vulnerabilities", "tags": [], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Multiple SQL injection vulnerabilities in eLineStudio Site Composer (ESC) 2.6 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to ansFAQ.asp and the (2) template_id parameter to preview.asp."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-89"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2008-2862", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "HIGH", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}}, "publishedDate": "2008-06-25T12:36Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:elinestudio:site_composer:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "2.6"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-11T20:44Z"}