CVE-2008-4161 SQL injection vulnerability in search_inv.php in Assetman 2.5b allows remote attackers to execute arbitrary SQL commands and conduct session fixation attacks via a combination of crafted order and ord...
MediumCVSS 6.8
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
SQL injection vulnerability in search_inv.php in Assetman 2.5b allows remote attackers to execute arbitrary SQL commands and conduct session fixation attacks via a combination of crafted order and order_by parameters in a search_all action.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| assetman | = 2.5b | No fix listed |
References
- 31935 third-party-advisory vendor-advisory
- 4287 third-party-advisory
- 31248 vdb-entry
- assetman-searchinv-sql-injection(45233) vdb-entry
- 6490 exploit