vulnwire
7.5high

CVE-2008-70912 exploits

Multiple SQL injection vulnerabilities in Pligg 9.9 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id par…

Published 17 y ago · modified 4 mo ago · JSON

CVSS
7.5
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
2.1%
percentile 82%
Public exploits
2
Exploit-DB

Multiple SQL injection vulnerabilities in Pligg 9.9 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to vote.php, which is not properly handled in libs/link.php; (2) id parameter to trackback.php; (3) an unspecified parameter to submit.php; (4) requestTitle variable in a query to story.php; (5) requestID and (6) requestTitle variables in recommend.php; (7) categoryID parameter to cloud.php; (8) title parameter to out.php; (9) username parameter to login.php; (10) id parameter to cvote.php; and (11) commentid parameter to edit.php.

Exploit prediction (EPSS)

2.10% probability of exploitation in the next 30 days, higher than 82% of all scored CVEs.

Exploits and detections

  • EDB-6173 Pligg CMS 9.9.0 - Cross-Site Scripting / Local File Inclusion / SQL Injection · webapps · 2008-07-30
  • EDB-6172 Pligg CMS 9.9.0 - Remote Code Execution · webapps · 2008-07-30

CVSS scores

Assigned byVersionScoreVector
NVD2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P

Classification

Weakness
  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command

References

  • osvdb.org /50191 · vdb-entry, x_refsource_OSVDB, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/44193 · vdb-entry, x_refsource_XF, x_transferred
  • osvdb.org /50198 · vdb-entry, x_refsource_OSVDB, x_transferred
  • osvdb.org /50195 · vdb-entry, x_refsource_OSVDB, x_transferred
  • osvdb.org /50193 · vdb-entry, x_refsource_OSVDB, x_transferred
  • gulftech.org /?node=research&article_id=00120-07312008 · x_refsource_MISC, x_transferred
  • securityfocus.com /archive/1/494987/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • osvdb.org /50194 · vdb-entry, x_refsource_OSVDB, x_transferred
  • securityfocus.com /bid/30458 · vdb-entry, x_refsource_BID, x_transferred
  • osvdb.org /50190 · vdb-entry, x_refsource_OSVDB, x_transferred
  • osvdb.org /50192 · vdb-entry, x_refsource_OSVDB, x_transferred
  • osvdb.org /50189 · vdb-entry, x_refsource_OSVDB, x_transferred
  • osvdb.org /50196 · vdb-entry, x_refsource_OSVDB, x_transferred
  • osvdb.org /50197 · vdb-entry, x_refsource_OSVDB, x_transferred
  • exploit-db.com /exploits/6173 · exploit, x_refsource_EXPLOIT-DB, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.