SQL injection vulnerability in logon.jsp in Ad Server Solutions Affiliate Software Java 4.0 allows remote attackers to execute arbitrary SQ…

Published 17 y ago 2009-03-02 · modified 4 mo ago 2026-06-16 · JSON

CVSS

7.5

v2.0 · NVD

CISA KEV

not known exploited

EPSS

3.4%

percentile 89%

Public exploits

Exploit-DB

SQL injection vulnerability in logon.jsp in Ad Server Solutions Affiliate Software Java 4.0 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password, possibly related to the uname and pass parameters to logon_process.jsp. NOTE: some of these details are obtained from third party information.

Exploit prediction (EPSS)

3.35% probability of exploitation in the next 30 days, higher than 89% of all scored CVEs.

Exploits and detections

EDB-7423 Affiliate Software Java 4.0 - Authentication Bypass · webapps · 2008-12-11
EDB-32655 Multiple Ad Server Solutions Products - 'logon_processing.jsp' SQL Injection · webapps · 2008-12-11

CVSS scores

Assigned by	Version	Score	Vector
NVD	2.0	7.5	`AV:N/AC:L/Au:N/C:P/I:P/A:P`

Classification

Weakness

CWE-89 Improper Neutralization of Special Elements used in an SQL Command

References

exploit-db.com /exploits/7423 · exploit, x_refsource_EXPLOIT-DB, x_transferred
secunia.com /advisories/33072 · third-party-advisory, x_refsource_SECUNIA, x_transferred
exchange.xforce.ibmcloud.com /vulnerabilities/47280 · vdb-entry, x_refsource_XF, x_transferred
securityfocus.com /bid/32791 · vdb-entry, x_refsource_BID, x_transferred
packetstorm.linuxsecurity.com /0812-exploits/affiliatesj-sql.txt · x_refsource_MISC, x_transferred

Sources

CVE List: CVE-2008-6366
NVD: CVE-2008-6366

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.