CVE-2008-1496

Multiple SQL injection vulnerabilities in PEEL, possibly 3.x and earlier, allow remote attackers to execute arbitrary SQL commands via the (1) email parameter to (a) membre.php, and the (2) timestamp parameter to (b) the details action in achat/historique_commandes.php and (c) the facture action in factures/facture_html.php.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:P/I:P/A:P
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 76%
VendorProductVersion
peelpeel
1.0b:b
peelpeel
2.6
peelpeel
2.7
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://realn.free.fr/releases/70207
http://secunia.com/advisories/29466
http://www.securityfocus.com/bid/28346
https://exchange.xforce.ibmcloud.com/vulnerabilities/41341
https://exchange.xforce.ibmcloud.com/vulnerabilities/41353
https://www.exploit-db.com/exploits/5281
http://realn.free.fr/releases/70207
http://secunia.com/advisories/29466
http://www.securityfocus.com/bid/28346
https://exchange.xforce.ibmcloud.com/vulnerabilities/41341
https://exchange.xforce.ibmcloud.com/vulnerabilities/41353
https://www.exploit-db.com/exploits/5281