CVE-2008-3788

EUVD-2008-3774
Multiple SQL injection vulnerabilities in PICTURESPRO Photo Cart 3.9, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) qtitle, (2) qid, and (3) qyear parameters to (a) search.php, and the (4) email and (5) password parameters to (b) _login.php.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.8 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:P
Base Score
CVSS 3.x
EPSS Score
Percentile: 69%
Affected Products (NVD)
VendorProductVersion
picturespropicturespro_photo_cart
3.9
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://packetstormsecurity.org/0808-exploits/photocart-sql.txt
http://securityreason.com/securityalert/4188
http://www.securityfocus.com/bid/30786
https://exchange.xforce.ibmcloud.com/vulnerabilities/44607
https://www.exploit-db.com/exploits/6285
http://packetstormsecurity.org/0808-exploits/photocart-sql.txt
http://securityreason.com/securityalert/4188
http://www.securityfocus.com/bid/30786
https://exchange.xforce.ibmcloud.com/vulnerabilities/44607
https://www.exploit-db.com/exploits/6285