← back
CVE-2008-0371

CVE-2008-0371

23Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 1.1%
exploitation probability
1.1%top 37% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
Multiple SQL injection vulnerabilities in aliTalk 1.9.1.1, when magic_quotes_gpc is disabled, allow remote authenticated users to execute arbitrary SQL commands via (1) the mohit parameter to (a) inc/receivertwo.php; and allow remote attackers to execute arbitrary SQL commands via (2) the id parameter to (b) inc/usercp.php, related to functionz/usercp.php; or (3) the username parameter to (c) admin/index.php, related to functionz/first_process.php, or (d) index.php. NOTE: some of these details are obtained from third party information.
Affected products
n/a · n/a
public PoCs found — 1✓ VexDay Proof
cve_reference✓ VexDay Proofwww.exploit-db.com/exploits/4922
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
http://secunia.com/advisories/28515https://exchange.xforce.ibmcloud.com/vulnerabilities/39733https://exchange.xforce.ibmcloud.com/vulnerabilities/39735https://exchange.xforce.ibmcloud.com/vulnerabilities/39736https://exchange.xforce.ibmcloud.com/vulnerabilities/39745https://www.exploit-db.com/exploits/4922http://www.securityfocus.com/bid/27315