CVE-2008-5335 - Vulnerability Details - OpenCVE

SQL injection vulnerability in messages.php in PHP-Fusion 6.01.15 and 7.00.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the subject and msg_send parameters, a different vector than CVE-2005-3157, CVE-2005-3158, CVE-2005-3159, CVE-2005-4005, and CVE-2006-2459.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Php-fusion	Php-fusion

Configuration 1 [-]

OR	cpe:2.3:a:php-fusion:php-fusion:6.01.15:::::::*
	cpe:2.3:a:php-fusion:php-fusion:7.00.1:::::::*

No data.

References

Link	Providers
http://osvdb.org/50065
http://secunia.com/advisories/32781
http://securityreason.com/securityalert/4688
http://www.php-fusion.co.uk/downloads.php?cat_id=19
http://www.php-fusion.co.uk/news.php?readmore=435
http://www.php-fusion.co.uk/news.php?readmore=436
http://www.securityfocus.com/bid/32388
http://www.vupen.com/english/advisories/2008/3248
https://exchange.xforce.ibmcloud.com/vulnerabilities/46760
https://www.exploit-db.com/exploits/7173

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2008-12-05T01:00:00

Updated: 2024-08-07T10:49:12.275Z

Reserved: 2008-12-04T00:00:00

Link: CVE-2008-5335

Vulnrichment

No data.

NVD

Status : Modified

Published: 2008-12-05T01:30:00.407

Modified: 2024-11-21T00:53:51.530

Link: CVE-2008-5335

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2008-11-20T00:00:00", "descriptions": [{"lang": "en", "value": "SQL injection vulnerability in messages.php in PHP-Fusion 6.01.15 and 7.00.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the subject and msg_send parameters, a different vector than CVE-2005-3157, CVE-2005-3158, CVE-2005-3159, CVE-2005-4005, and CVE-2006-2459."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-09-28T12:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "phpfusion-msgsend-sql-injection(46760)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46760"}, {"name": "32781", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/32781"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.php-fusion.co.uk/news.php?readmore=435"}, {"name": "32388", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/32388"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.php-fusion.co.uk/downloads.php?cat_id=19"}, {"name": "ADV-2008-3248", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2008/3248"}, {"name": "4688", "tags": ["third-party-advisory", "x_refsource_SREASON"], "url": "http://securityreason.com/securityalert/4688"}, {"name": "50065", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/50065"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.php-fusion.co.uk/news.php?readmore=436"}, {"name": "7173", "tags": ["exploit", "x_refsource_EXPLOIT-DB"], "url": "https://www.exploit-db.com/exploits/7173"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2008-5335", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "SQL injection vulnerability in messages.php in PHP-Fusion 6.01.15 and 7.00.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the subject and msg_send parameters, a different vector than CVE-2005-3157, CVE-2005-3158, CVE-2005-3159, CVE-2005-4005, and CVE-2006-2459."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "phpfusion-msgsend-sql-injection(46760)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46760"}, {"name": "32781", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/32781"}, {"name": "http://www.php-fusion.co.uk/news.php?readmore=435", "refsource": "CONFIRM", "url": "http://www.php-fusion.co.uk/news.php?readmore=435"}, {"name": "32388", "refsource": "BID", "url": "http://www.securityfocus.com/bid/32388"}, {"name": "http://www.php-fusion.co.uk/downloads.php?cat_id=19", "refsource": "CONFIRM", "url": "http://www.php-fusion.co.uk/downloads.php?cat_id=19"}, {"name": "ADV-2008-3248", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2008/3248"}, {"name": "4688", "refsource": "SREASON", "url": "http://securityreason.com/securityalert/4688"}, {"name": "50065", "refsource": "OSVDB", "url": "http://osvdb.org/50065"}, {"name": "http://www.php-fusion.co.uk/news.php?readmore=436", "refsource": "CONFIRM", "url": "http://www.php-fusion.co.uk/news.php?readmore=436"}, {"name": "7173", "refsource": "EXPLOIT-DB", "url": "https://www.exploit-db.com/exploits/7173"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T10:49:12.275Z"}, "title": "CVE Program Container", "references": [{"name": "phpfusion-msgsend-sql-injection(46760)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46760"}, {"name": "32781", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/32781"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.php-fusion.co.uk/news.php?readmore=435"}, {"name": "32388", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/32388"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.php-fusion.co.uk/downloads.php?cat_id=19"}, {"name": "ADV-2008-3248", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2008/3248"}, {"name": "4688", "tags": ["third-party-advisory", "x_refsource_SREASON", "x_transferred"], "url": "http://securityreason.com/securityalert/4688"}, {"name": "50065", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/50065"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.php-fusion.co.uk/news.php?readmore=436"}, {"name": "7173", "tags": ["exploit", "x_refsource_EXPLOIT-DB", "x_transferred"], "url": "https://www.exploit-db.com/exploits/7173"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2008-5335", "datePublished": "2008-12-05T01:00:00", "dateReserved": "2008-12-04T00:00:00", "dateUpdated": "2024-08-07T10:49:12.275Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:php-fusion:php-fusion:6.01.15:*:*:*:*:*:*:*", "matchCriteriaId": "11019A94-11B0-438E-AB2C-A216C0079788", "vulnerable": true}, {"criteria": "cpe:2.3:a:php-fusion:php-fusion:7.00.1:*:*:*:*:*:*:*", "matchCriteriaId": "29C3B75C-A4A7-4144-AA56-ACA16382535D", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "SQL injection vulnerability in messages.php in PHP-Fusion 6.01.15 and 7.00.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the subject and msg_send parameters, a different vector than CVE-2005-3157, CVE-2005-3158, CVE-2005-3159, CVE-2005-4005, and CVE-2006-2459."}, {"lang": "es", "value": "Vulnerabilidad de inyecci\u00f3n SQL en messages.php en PHP-Fusion v6.01.15 y v7.00.1, cuando magic_quotes_gpc se deshabilita, permitir\u00eda a atacantes remotos ejecutar comando SQL a su elecci\u00f3n a traves de los parametros \"subject\" y \"msg_send\", es un vector diferente que CVE-2005-3157, CVE-2005-3158, CVE-2005-3159, CVE-2005-4005, y CVE-2006-2459."}], "id": "CVE-2008-5335", "lastModified": "2024-11-21T00:53:51.530", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": true, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2008-12-05T01:30:00.407", "references": [{"source": "cve@mitre.org", "url": "http://osvdb.org/50065"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/32781"}, {"source": "cve@mitre.org", "url": "http://securityreason.com/securityalert/4688"}, {"source": "cve@mitre.org", "tags": ["Patch", "Vendor Advisory"], "url": "http://www.php-fusion.co.uk/downloads.php?cat_id=19"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "http://www.php-fusion.co.uk/news.php?readmore=435"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "http://www.php-fusion.co.uk/news.php?readmore=436"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://www.securityfocus.com/bid/32388"}, {"source": "cve@mitre.org", "url": "http://www.vupen.com/english/advisories/2008/3248"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46760"}, {"source": "cve@mitre.org", "url": "https://www.exploit-db.com/exploits/7173"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://osvdb.org/50065"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/32781"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://securityreason.com/securityalert/4688"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "http://www.php-fusion.co.uk/downloads.php?cat_id=19"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "http://www.php-fusion.co.uk/news.php?readmore=435"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "http://www.php-fusion.co.uk/news.php?readmore=436"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://www.securityfocus.com/bid/32388"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.vupen.com/english/advisories/2008/3248"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46760"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.exploit-db.com/exploits/7173"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "nvd@nist.gov", "type": "Primary"}]}