Lucene search

[email protected]CVE-2008-2669

HistoryJun 12, 2008 - 2:32 a.m.

CVE-2008-2669

2008-06-1202:32:00

CWE-89

[email protected]

web.nvd.nist.gov

#sql injection

yblog

cve-2008-2669

security vulnerability

remote code execution

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

8.5 High

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

68.9%

JSON

Multiple SQL injection vulnerabilities in yBlog 0.2.2.2 allow remote attackers to execute arbitrary SQL commands via (1) the q parameter to search.php, or the n parameter to (2) user.php or (3) uss.php.

Affected configurations

NVD

Node

y-blogyblogMatch0.2.2.2

CPENameOperatorVersion
y-blog:yblogy-blog yblogeq0.2.2.2

CPE	Name	Operator	Version
y-blog:yblog	y-blog yblog	eq	0.2.2.2

References

chroot.org/exploits/chroot_uu_009

secunia.com/advisories/30607

securityreason.com/securityalert/3935

www.securityfocus.com/archive/1/493222/100/0/threaded

www.securityfocus.com/bid/29629

exchange.xforce.ibmcloud.com/vulnerabilities/42959

www.exploit-db.com/exploits/5773

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

8.5 High

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

68.9%

JSON

Related for CVE-2008-2669

prion1 cvelist1 nvd1