CVE-2008-2901

EUVD-2008-2894
Multiple SQL injection vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 1.4 allow remote authenticated users to execute arbitrary SQL commands via the (1) address parameter to addressbook.php, the (2) getnews parameter to familynews.php, and the (3) poll_id parameter to home.php in a results action.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:S/C:P/I:P/A:P
Base Score
CVSS 3.x
EPSS Score
Percentile: 61%
Affected Products (NVD)
VendorProductVersion
haudenschiltfamily_connections_cms
1.4
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://secunia.com/advisories/30680
http://www.securityfocus.com/bid/29722
https://exchange.xforce.ibmcloud.com/vulnerabilities/43097
https://www.exploit-db.com/exploits/5811
http://secunia.com/advisories/30680
http://www.securityfocus.com/bid/29722
https://exchange.xforce.ibmcloud.com/vulnerabilities/43097
https://www.exploit-db.com/exploits/5811