CVE-2008-3845

Multiple SQL injection vulnerabilities in Crafty Syntax Live Help (CSLH) 2.14.6 and earlier allow remote attackers to execute arbitrary SQL commands via the department parameter to (1) is_xmlhttp.php and (2) is_flush.php.

Link	Resource
http://www.gulftech.org/?node=research&article_id=00127-08252008	Exploit
http://security.craftysyntax.com/updates/?v=2.14.6	Patch
http://sourceforge.net/project/shownotes.php?release_id=620878
http://www.securityfocus.com/bid/30825	Exploit
http://secunia.com/advisories/31573	Vendor Advisory
http://securityreason.com/securityalert/4192
https://exchange.xforce.ibmcloud.com/vulnerabilities/44669
https://www.exploit-db.com/exploits/6307
http://www.securityfocus.com/archive/1/495729/100/0/threaded

Configuration 1

cpe:2.3:a:craftysyntax:crafty_syntax_live_help:2.11.4:*:*:*:*:*:*:* cpe:2.3:a:craftysyntax:crafty_syntax_live_help:2.14.5:*:*:*:*:*:*:* cpe:2.3:a:craftysyntax:crafty_syntax_live_help:2.0:*:*:*:*:*:*:* cpe:2.3:a:craftysyntax:crafty_syntax_live_help:2.12.5:*:*:*:*:*:*:* cpe:2.3:a:craftysyntax:crafty_syntax_live_help:2.14.4:*:*:*:*:*:*:* cpe:2.3:a:craftysyntax:crafty_syntax_live_help:2.11.2:*:*:*:*:*:*:* cpe:2.3:a:craftysyntax:crafty_syntax_live_help:2.11.7:*:*:*:*:*:*:* cpe:2.3:a:craftysyntax:crafty_syntax_live_help:2.11.1:*:*:*:*:*:*:* cpe:2.3:a:craftysyntax:crafty_syntax_live_help:1.0:*:*:*:*:*:*:* cpe:2.3:a:craftysyntax:crafty_syntax_live_help:1.6:*:*:*:*:*:*:* cpe:2.3:a:craftysyntax:crafty_syntax_live_help:2.12.9:*:*:*:*:*:*:* cpe:2.3:a:craftysyntax:crafty_syntax_live_help:2.12.6:*:*:*:*:*:*:* cpe:2.3:a:craftysyntax:crafty_syntax_live_help:2.12.4:*:*:*:*:*:*:* cpe:2.3:a:craftysyntax:crafty_syntax_live_help:1.3:*:*:*:*:*:*:* cpe:2.3:a:craftysyntax:crafty_syntax_live_help:2.11.0:*:*:*:*:*:*:* cpe:2.3:a:craftysyntax:crafty_syntax_live_help:2.12.1:*:*:*:*:*:*:* cpe:2.3:a:craftysyntax:crafty_syntax_live_help:1.5:*:*:*:*:*:*:* cpe:2.3:a:craftysyntax:crafty_syntax_live_help:2.10.1:*:*:*:*:*:*:* cpe:2.3:a:craftysyntax:crafty_syntax_live_help:2.12.2:*:*:*:*:*:*:* cpe:2.3:a:craftysyntax:crafty_syntax_live_help:2.12.3:*:*:*:*:*:*:* cpe:2.3:a:craftysyntax:crafty_syntax_live_help:2.11.5:*:*:*:*:*:*:* cpe:2.3:a:craftysyntax:crafty_syntax_live_help:2.11.6:*:*:*:*:*:*:* cpe:2.3:a:craftysyntax:crafty_syntax_live_help:2.14.1:*:*:*:*:*:*:* cpe:2.3:a:craftysyntax:crafty_syntax_live_help:*:*:*:*:*:*:*:* cpe:2.3:a:craftysyntax:crafty_syntax_live_help:1.1:*:*:*:*:*:*:* cpe:2.3:a:craftysyntax:crafty_syntax_live_help:2.13.0:*:*:*:*:*:*:* cpe:2.3:a:craftysyntax:crafty_syntax_live_help:2.10.3:*:*:*:*:*:*:* cpe:2.3:a:craftysyntax:crafty_syntax_live_help:2.12.7:*:*:*:*:*:*:* cpe:2.3:a:craftysyntax:crafty_syntax_live_help:2.12.8:*:*:*:*:*:*:* cpe:2.3:a:craftysyntax:crafty_syntax_live_help:1.2:*:*:*:*:*:*:* cpe:2.3:a:craftysyntax:crafty_syntax_live_help:2.14.0:*:*:*:*:*:*:* cpe:2.3:a:craftysyntax:crafty_syntax_live_help:1.7:*:*:*:*:*:*:* cpe:2.3:a:craftysyntax:crafty_syntax_live_help:2.10.4:*:*:*:*:*:*:* cpe:2.3:a:craftysyntax:crafty_syntax_live_help:1.4:*:*:*:*:*:*:* cpe:2.3:a:craftysyntax:crafty_syntax_live_help:2.14.3:*:*:*:*:*:*:* cpe:2.3:a:craftysyntax:crafty_syntax_live_help:2.10.0:*:*:*:*:*:*:* cpe:2.3:a:craftysyntax:crafty_syntax_live_help:2.1:*:*:*:*:*:*:* cpe:2.3:a:craftysyntax:crafty_syntax_live_help:2.10.2:*:*:*:*:*:*:* cpe:2.3:a:craftysyntax:crafty_syntax_live_help:2.13.1:*:*:*:*:*:*:* cpe:2.3:a:craftysyntax:crafty_syntax_live_help:2.10.5:*:*:*:*:*:*:* cpe:2.3:a:craftysyntax:crafty_syntax_live_help:2.11.3:*:*:*:*:*:*:* cpe:2.3:a:craftysyntax:crafty_syntax_live_help:2.14.2:*:*:*:*:*:*:* cpe:2.3:a:craftysyntax:crafty_syntax_live_help:2.12.0:*:*:*:*:*:*:*

---

Published : 2008-08-27 11:41

Updated : 2018-10-11 08:49

---

NVD link : CVE-2008-3845

Mitre link : CVE-2008-3845

No products.

CWE-89