CVE-2008-0267 Multiple SQL injection vulnerabilities in eTicket 1.5.5.2 allow remote authenticated users to execute arbitrary SQL commands via the (1) status, (2) sort, and (3) way parameters to search.php; and all...
HighCVSS 7.5
EPSS 1.2%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple SQL injection vulnerabilities in eTicket 1.5.5.2 allow remote authenticated users to execute arbitrary SQL commands via the (1) status, (2) sort, and (3) way parameters to search.php; and allow remote authenticated administrators to execute arbitrary SQL commands via the (4) msg and (5) password parameters to admin.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| eticket | = 1.5.5.2 | No fix listed |
References
- 28331 third-party-advisory vendor-advisory
- 3542 third-party-advisory
- 20080106 eTicket 1.5.5.2 Multiple Vulnerabilities mailing-list
- 27173 exploit vdb-entry
- eticket-admin-sql-injection(39487) vdb-entry
- eticket-search-sql-injection(39489) vdb-entry