CVE-2008-3788 Multiple SQL injection vulnerabilities in PICTURESPRO Photo Cart 3.9, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) qtitle, (2) qid, and (3) q...
MediumCVSS 6.8
EPSS 1.1%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple SQL injection vulnerabilities in PICTURESPRO Photo Cart 3.9, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) qtitle, (2) qid, and (3) qyear parameters to (a) search.php, and the (4) email and (5) password parameters to (b) _login.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| picturespro photo cart | = 3.9 | No fix listed |
References
- packetstormsecurity.org exploit
- 4188 third-party-advisory
- 30786 exploit vdb-entry
- photocart-search-login-sql-injection(44607) vdb-entry
- 6285 exploit