Skip to content

CVE-2008-5892 Multiple SQL injection vulnerabilities in ClickAndEmail allow remote attackers to execute arbitrary SQL commands via (1) the ID parameter to admin_dblayers.asp in an update action, (2) the adminid par...

HighCVSS 7.5 EPSS 0.97%
Published
Updated
Exploit status
No public exploit known
Sign in for asset impact Search another CVE

Description

Multiple SQL injection vulnerabilities in ClickAndEmail allow remote attackers to execute arbitrary SQL commands via (1) the ID parameter to admin_dblayers.asp in an update action, (2) the adminid parameter to admin_loginCheck.asp (aka the USERNAME field in admin_main.asp), and (3) the PassWord parameter to admin_loginCheck.asp (aka the PASSWORD field in admin_main.asp). NOTE: some of these details are obtained from third party information.

Affected products

ProductAffected versionsFixed in
icash clickemail = _nil_ No fix listed

References

  • 33155 third-party-advisory vendor-advisory
  • 4903 third-party-advisory
  • 32857 exploit vdb-entry
  • 7485 exploit