CVE-2008-2843

EUVD-2008-2836
Multiple SQL injection vulnerabilities in doITLive CMS 2.50 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) ID parameter in an USUB action to default.asp and the (2) Licence[SpecialLicenseNumber] (aka LicenceId) cookie to edit/default.asp.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:P/I:P/A:P
Base Score
CVSS 3.x
EPSS Score
Percentile: 75%
Affected Products (NVD)
VendorProductVersion
doitlivecms
𝑥
≤ 2.50
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://secunia.com/advisories/30705
http://www.bugreport.ir/?/43
http://www.securityfocus.com/bid/29789
https://exchange.xforce.ibmcloud.com/vulnerabilities/43161
https://exchange.xforce.ibmcloud.com/vulnerabilities/43163
https://www.exploit-db.com/exploits/5849
http://secunia.com/advisories/30705
http://www.bugreport.ir/?/43
http://www.securityfocus.com/bid/29789
https://exchange.xforce.ibmcloud.com/vulnerabilities/43161
https://exchange.xforce.ibmcloud.com/vulnerabilities/43163
https://www.exploit-db.com/exploits/5849