CVE-2008-6180

🗓️ 19 Feb 2009 18:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov👁 58 Views🌐 WEB

SQL injection vuln in system/nlb_user.class.php in NewLife Blogger 3.0 & earlier, possibly 3.3.1, allows remote attackers to execute arbitrary SQL commands via nlb3 cookie

Reporter	Title	Published	Views	Family All 7
Circl	CVE-2008-6180	12 Oct 200800:00	–	circl
Cvelist	CVE-2008-6180	19 Feb 200918:00	–	cvelist
Exploit DB	NewLife Blogger 3.0 - Insecure Cookie Handling / SQL Injection	12 Oct 200800:00	–	exploitdb
EUVD	EUVD-2008-6150	7 Oct 202500:30	–	euvd
NVD	CVE-2008-6180	19 Feb 200918:30	–	nvd
Prion	Sql injection	19 Feb 200918:30	–	prion
Rapid7 Vulnerability Database (full)	CVE-2008-6180: Improper Neutralization of Special Elements used in an SQL Command	19 Feb 200900:00	–	rapid7

NVD

Node

newlife_blogger newlife_bloggerRange≤3.0

newlife_blogger newlife_bloggerMatch3.3.1

Source	Link
exchange	www.exchange.xforce.ibmcloud.com/vulnerabilities/45820
exploit-db	www.exploit-db.com/exploits/6739
vupen	www.vupen.com/english/advisories/2008/2797
pepelux	www.pepelux.org/exploits/newlife-es.txt
secunia	www.secunia.com/advisories/32214
exchange	www.exchange.xforce.ibmcloud.com/vulnerabilities/45821
securityfocus	www.securityfocus.com/bid/31728
securityfocus	www.securityfocus.com/archive/1/497283/100/0/threaded

Parameter	Position	Path	Description	CWE
nlb3	header	/system/nlb_user.class.php	SQL injection vulnerability in the nlb3 cookie where the 'id' portion is concatenated into a SQL query without sanitization.	CWE-89

16 Jun 2026 23:01Current

8.7High risk

Vulners AI Score8.7

CVSS 27.5

EPSS0.01681

CWE-89