CVE-2008-1726

EUVD-2008-1727
Multiple SQL injection vulnerabilities in KnowledgeQuest 2.6, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) kqid parameter to (a) articletext.php and (b) articletextonly.php and the (2) username parameter to (c) logincheck.php.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.8 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:P
Base Score
CVSS 3.x
EPSS Score
Percentile: 80%
Affected Products (NVD)
VendorProductVersion
myknowledgequestknowledgequest
2.6
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://secunia.com/advisories/29716
http://www.osvdb.org/44254
http://www.osvdb.org/44255
http://www.osvdb.org/44256
http://www.securityfocus.com/bid/28713
http://www.securityfocus.com/bid/28716
https://exchange.xforce.ibmcloud.com/vulnerabilities/41746
https://www.exploit-db.com/exploits/5421
http://secunia.com/advisories/29716
http://www.osvdb.org/44254
http://www.osvdb.org/44255
http://www.osvdb.org/44256
http://www.securityfocus.com/bid/28713
http://www.securityfocus.com/bid/28716
https://exchange.xforce.ibmcloud.com/vulnerabilities/41746
https://www.exploit-db.com/exploits/5421