CVE-2008-2843 Multiple SQL injection vulnerabilities in doITLive CMS 2.50 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) ID parameter in an USUB action to default.asp and the (2) L...
HighCVSS 7.5
EPSS 1.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple SQL injection vulnerabilities in doITLive CMS 2.50 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) ID parameter in an USUB action to default.asp and the (2) Licence[SpecialLicenseNumber] (aka LicenceId) cookie to edit/default.asp.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| doitlive cms | <= 2.50 | No fix listed |
References
- 30705 third-party-advisory vendor-advisory
- www.bugreport.ir exploit
- 29789 exploit vdb-entry
- doitlive-default-sql-injection(43161) vdb-entry
- doitlive-licence-sql-injection(43163) vdb-entry
- 5849 exploit