CVE-2008-1895

Multiple SQL injection vulnerabilities in Carbon Communities 2.4 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) ID parameter to events.asp, the (2) UserName parameter to getpassword.asp, and possibly an unspecified parameter to (3) option_Update.asp in an edit action.

Link	Resource
http://bugreport.ir/index.php?/35	Exploit
http://bugreport.ir/index.php?/35/exploit	Exploit
http://www.securityfocus.com/bid/28806	Exploit
http://secunia.com/advisories/29827	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/41845
https://www.exploit-db.com/exploits/5456
http://www.securityfocus.com/archive/1/490923/100/0/threaded

Configuration 1

cpe:2.3:a:carboncommunities:carbon_communities:2.3:*:*:*:*:*:*:* cpe:2.3:a:carboncommunities:carbon_communities:1.0:*:*:*:*:*:*:* cpe:2.3:a:carboncommunities:carbon_communities:*:*:*:*:*:*:*:* cpe:2.3:a:carboncommunities:carbon_communities:1.1:*:*:*:*:*:*:* cpe:2.3:a:carboncommunities:carbon_communities:2.1:*:*:*:*:*:*:* cpe:2.3:a:carboncommunities:carbon_communities:2.2:*:*:*:*:*:*:*

---

Published : 2008-04-18 10:05

Updated : 2018-10-11 08:37

---

NVD link : CVE-2008-1895

Mitre link : CVE-2008-1895

No products.

CWE-89