CVE-2008-7267 SQL injection vulnerability in announcements.php in SiteEngine 5.x allows remote attackers to execute arbitrary SQL commands via the id parameter.

HighCVSS 7.5 EPSS 1.2% Public exploit

Published: 2010-12-01 18:00
Updated: 2026-06-17 02:03
Exploit status: Public exploit available

Sign in for asset impact Search another CVE

Description

SQL injection vulnerability in announcements.php in SiteEngine 5.x allows remote attackers to execute arbitrary SQL commands via the id parameter.

Affected products

Product	Affected versions	Fixed in
boka siteengine	= 5.0	No fix listed

References

32404 third-party-advisory vendor-advisory
20081023 SiteEngine 5.x Multiple Remote Vulnerabilities mailing-list
31889 vdb-entry
6823 exploit

CVSS v2.0

7.5 High

AV:N/AC:L/Au:N/C:P/I:P/A:P

Access Vector: Network
Access Complexity: Low
Authentication: None
Confidentiality: Partial
Integrity: Partial
Availability: Partial

Weakness & likelihood

EPSS (exploitation probability, 30 days): 1.16% (percentile 67.7)
CWE: CWE-89

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

UC Gateway Investment SiteEngine 5.0 - 'announcements.php' SQL Injection Exploit · Exploit Database (OffSec) · 2008-10-23
SiteEngine 5.x - Multiple Vulnerabilities Exploit · Exploit Database (OffSec) · 2008-10-23