CVE-2008-3591 SQL injection vulnerability in lib/class.admin.php in Twentyone Degrees Symphony 1.7.01 and earlier allows remote attackers to execute arbitrary SQL commands via the sym_auth cookie in a /publish/file...
HighCVSS 7.5
EPSS 2.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
SQL injection vulnerability in lib/class.admin.php in Twentyone Degrees Symphony 1.7.01 and earlier allows remote attackers to execute arbitrary SQL commands via the sym_auth cookie in a /publish/filemanager/ request to index.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| 21degrees symphony | <= 1.7.01 | No fix listed |
| 21degrees symphony | = 1.1 | No fix listed |
| 21degrees symphony | = 1.5 | No fix listed |
| 21degrees symphony | = 1.5.05 | No fix listed |
| 21degrees symphony | = 1.5.06 | No fix listed |
| 21degrees symphony | = 1.6.02 | No fix listed |
| 21degrees symphony | = 1.7 | No fix listed |
References
- overture21.com patch
- 31293 patch third-party-advisory vendor-advisory
- 4137 third-party-advisory
- 30477 vdb-entry
- 6177 exploit