National Cyber Awareness System

Vulnerability Summary for CVE-2008-7091

Overview

Multiple SQL injection vulnerabilities in Pligg 9.9 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to vote.php, which is not properly handled in libs/link.php; (2) id parameter to trackback.php; (3) an unspecified parameter to submit.php; (4) requestTitle variable in a query to story.php; (5) requestID and (6) requestTitle variables in recommend.php; (7) categoryID parameter to cloud.php; (8) title parameter to out.php; (9) username parameter to login.php; (10) id parameter to cvote.php; and (11) commentid parameter to edit.php.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: XF

Name: pligg-multiple-sql-injection(44193)

Hyperlink:http://xforce.iss.net/xforce/xfdb/44193

External Source: BID

Name: 30458

Hyperlink:http://www.securityfocus.com/bid/30458

External Source: BUGTRAQ

Name: 20080730 Pligg <= 9.9.0 Multiple Vulnerabilities

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/494987/100/0/threaded

External Source: OSVDB

Name: 50198

Hyperlink:http://www.osvdb.org/50198

External Source: OSVDB

Name: 50197

Hyperlink:http://www.osvdb.org/50197

External Source: OSVDB

Name: 50196

Hyperlink:http://www.osvdb.org/50196

External Source: OSVDB

Name: 50195

Hyperlink:http://www.osvdb.org/50195

External Source: OSVDB

Name: 50194

Hyperlink:http://www.osvdb.org/50194

External Source: OSVDB

Name: 50193

Hyperlink:http://www.osvdb.org/50193

External Source: OSVDB

Name: 50192

Hyperlink:http://www.osvdb.org/50192

External Source: OSVDB

Name: 50191

Hyperlink:http://www.osvdb.org/50191

External Source: OSVDB

Name: 50190

Hyperlink:http://www.osvdb.org/50190

External Source: OSVDB

Name: 50189

Hyperlink:http://www.osvdb.org/50189

External Source: MILW0RM

Name: 6173

Hyperlink:http://www.milw0rm.com/exploits/6173

External Source: MISC

Name: http://www.gulftech.org/?node=research&article_id=00120-07312008

Hyperlink:http://www.gulftech.org/?node=research&article_id=00120-07312008