CVE-2008-4457 SQL injection vulnerability in inc/inc_statistics.php in MemHT Portal 3.9.0 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via a stats_res co...
MediumCVSS 6.8
EPSS 1.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
SQL injection vulnerability in inc/inc_statistics.php in MemHT Portal 3.9.0 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via a stats_res cookie to index.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| memht portal | <= 3.9.0 | No fix listed |
| memht portal | = 1.0-final | No fix listed |
| memht portal | = 1.5-full | No fix listed |
| memht portal | = 1.5-update | No fix listed |
| memht portal | = 2.0-full | No fix listed |
| memht portal | = 2.0-update | No fix listed |
| memht portal | = 2.5-full | No fix listed |
| memht portal | = 2.5-update | No fix listed |
| memht portal | = 2.9-full | No fix listed |
| memht portal | = 2.9-update | No fix listed |
| memht portal | = 3.0-full | No fix listed |
| memht portal | = 3.0-update | No fix listed |
| memht portal | = 3.1-full | No fix listed |
| memht portal | = 3.1-update | No fix listed |
| memht portal | = 3.2-update | No fix listed |
| memht portal | = 3.3-full | No fix listed |
| memht portal | = 3.3-update | No fix listed |
| memht portal | = 3.4-full | No fix listed |
| memht portal | = 3.4-update | No fix listed |
| memht portal | = 3.4.5-full | No fix listed |
| memht portal | = 3.4.5-update | No fix listed |
| memht portal | = 3.5.0-full | No fix listed |
| memht portal | = 3.6.0 | No fix listed |
| memht portal | = 3.6.5 | No fix listed |
| memht portal | = 3.7.0 | No fix listed |
Show 4 more
| Product | Affected versions | Fixed in |
|---|---|---|
| memht portal | = 3.7.5 | No fix listed |
| memht portal | = 3.8.0 | No fix listed |
| memht portal | = 3.8.1 | No fix listed |
| memht portal | = 3.8.5 | No fix listed |
References
- 31751 third-party-advisory vendor-advisory
- 4288 third-party-advisory
- www.memht.com patch
- 31045 patch vdb-entry
- ADV-2008-2510 vdb-entry
- memhtportal-incstatistics-sql-injection(44930) vdb-entry
- 6393 exploit