CVE-2008-4620 SQL injection vulnerability in Meeting Room Booking System (MRBS) before 1.4 allows remote attackers to execute arbitrary SQL commands via the area parameter to (1) month.php, and possibly (2) day.php...
HighCVSS 7.5
EPSS 1.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
SQL injection vulnerability in Meeting Room Booking System (MRBS) before 1.4 allows remote attackers to execute arbitrary SQL commands via the area parameter to (1) month.php, and possibly (2) day.php and (3) week.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mrbs | <= 1.2.6 | No fix listed |
| mrbs | = 0.5 | No fix listed |
| mrbs | = 0.6 | No fix listed |
| mrbs | = 0.7 | No fix listed |
| mrbs | = 0.8 | No fix listed |
| mrbs | = 0.8-pre1 | No fix listed |
| mrbs | = 0.8-pre2 | No fix listed |
| mrbs | = 0.8-pre3 | No fix listed |
| mrbs | = 0.8-pre4 | No fix listed |
| mrbs | = 0.8-pre5 | No fix listed |
| mrbs | = 0.8-pre6 | No fix listed |
| mrbs | = 0.9-pre-1 | No fix listed |
| mrbs | = 0.9-pre-2 | No fix listed |
| mrbs | = 0.9.1 | No fix listed |
| mrbs | = 0.9.2 | No fix listed |
| mrbs | = 1.0 | No fix listed |
| mrbs | = 1.0-pre-1 | No fix listed |
| mrbs | = 1.0-pre-2 | No fix listed |
| mrbs | = 1.1 | No fix listed |
| mrbs | = 1.1-pre-1 | No fix listed |
| mrbs | = 1.1-pre-2 | No fix listed |
| mrbs | = 1.2 | No fix listed |
| mrbs | = 1.2-pre-1 | No fix listed |
| mrbs | = 1.2-pre-2 | No fix listed |
| mrbs | = 1.2-pre-3 | No fix listed |
Show 6 more
| Product | Affected versions | Fixed in |
|---|---|---|
| mrbs | = 1.2.1 | No fix listed |
| mrbs | = 1.2.2 | No fix listed |
| mrbs | = 1.2.3 | No fix listed |
| mrbs | = 1.2.4 | No fix listed |
| mrbs | = 1.2.5 | No fix listed |
| mrbs | = 1.2.6.1 | No fix listed |
References
- 4450 third-party-advisory
- 31809 vdb-entry
- ADV-2008-2865 vdb-entry
- mrbs-area-sql-injection(45972) vdb-entry
- 6781 exploit