CVE-2008-5940

2009-01-2211:30:05

CWE-89

[email protected]

web.nvd.nist.gov

cve-2008-5940

sql injection

index.php

modx 0.9.6.2

remote code execution

searchid parameter

8.7 High

AI Score

Confidence

Low

6.8 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.008 Low

EPSS

Percentile

82.1%

JSON

SQL injection vulnerability in index.php in MODx 0.9.6.2 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the searchid parameter. NOTE: some of these details are obtained from third party information.

Affected configurations

NVD

Node

modxcmsmodxcmsRange≤0.9.6.2

modxcmsmodxcmsMatch0.9.0

modxcmsmodxcmsMatch0.9.1

modxcmsmodxcmsMatch0.9.2.1

modxcmsmodxcmsMatch0.9.5

modxcmsmodxcmsMatch0.9.6

modxcmsmodxcmsMatch0.9.6.1

CPENameOperatorVersion
modxcms:modxcmsmodxcmsle0.9.6.2
modxcms:modxcmsmodxcmseq0.9.0
modxcms:modxcmsmodxcmseq0.9.1
modxcms:modxcmsmodxcmseq0.9.2.1
modxcms:modxcmsmodxcmseq0.9.5
modxcms:modxcmsmodxcmseq0.9.6
modxcms:modxcmsmodxcmseq0.9.6.1

CPE	Name	Operator	Version
modxcms:modxcms	modxcms	le	0.9.6.2
modxcms:modxcms	modxcms	eq	0.9.0
modxcms:modxcms	modxcms	eq	0.9.1
modxcms:modxcms	modxcms	eq	0.9.2.1
modxcms:modxcms	modxcms	eq	0.9.5
modxcms:modxcms	modxcms	eq	0.9.6
modxcms:modxcms	modxcms	eq	0.9.6.1