CVE-2008-3191

Multiple SQL injection vulnerabilities in usercp.php in mForum 0.1a, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) City, (2) Interest, (3) Email, (4) Icq, (5) msn, or (6) Yahoo Messenger field in an edit_profile action.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.8 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:P
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 44%
VendorProductVersion
marcioforummforum
0.1a:a
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://securityreason.com/securityalert/4003
http://www.securityfocus.com/bid/30214
https://exchange.xforce.ibmcloud.com/vulnerabilities/43757
https://www.exploit-db.com/exploits/6068
http://securityreason.com/securityalert/4003
http://www.securityfocus.com/bid/30214
https://exchange.xforce.ibmcloud.com/vulnerabilities/43757
https://www.exploit-db.com/exploits/6068