CVE-2008-2670

Multiple SQL injection vulnerabilities in index.php in Insanely Simple Blog 0.5 allow remote attackers to execute arbitrary SQL commands via (1) the id parameter, or (2) the term parameter in a search action. NOTE: the current_subsection parameter is already covered by CVE-2007-3889.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:P/I:P/A:P
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 39%
VendorProductVersion
insanelysimple2isblog
0.5
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://chroot.org/exploits/chroot_uu_010
http://securityreason.com/securityalert/3938
http://www.securityfocus.com/archive/1/493224/100/0/threaded
http://www.securityfocus.com/bid/29630
https://www.exploit-db.com/exploits/5774
http://chroot.org/exploits/chroot_uu_010
http://securityreason.com/securityalert/3938
http://www.securityfocus.com/archive/1/493224/100/0/threaded
http://www.securityfocus.com/bid/29630
https://www.exploit-db.com/exploits/5774