CVE-2008-3297

Multiple SQL injection vulnerabilities in SocialEngine (SE) before 2.83 allow remote attackers to execute arbitrary SQL commands via (1) an se_user cookie to include/class_user.php or (2) an se_admin cookie to include/class_admin.php.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:P/I:P/A:P
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 71%
VendorProductVersion
social_enginesocial_engine
𝑥
≤ 2.81
social_enginesocial_engine
1.0
social_enginesocial_engine
1.1
social_enginesocial_engine
1.4
social_enginesocial_engine
1.6
social_enginesocial_engine
1.7
social_enginesocial_engine
1.8
social_enginesocial_engine
2.0
social_enginesocial_engine
2.0:online_beta
social_enginesocial_engine
2.1
social_enginesocial_engine
2.4
social_enginesocial_engine
2.5
social_enginesocial_engine
2.7
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://secunia.com/advisories/31203
http://securityreason.com/securityalert/4035
http://www.securityfocus.com/archive/1/494638/100/0/threaded
http://www.securityfocus.com/bid/30342
http://www.socialengine.net/news.php
https://exchange.xforce.ibmcloud.com/vulnerabilities/43958
http://secunia.com/advisories/31203
http://securityreason.com/securityalert/4035
http://www.securityfocus.com/archive/1/494638/100/0/threaded
http://www.securityfocus.com/bid/30342
http://www.socialengine.net/news.php
https://exchange.xforce.ibmcloud.com/vulnerabilities/43958