CVE-2008-6438

EPSS 3.4%

SQL injection vulnerability in macgurublog_menu/macgurublog.php in the MacGuru BLOG Engine plugin 2.2 for e107 allows remote attackers to execute arbitrary SQL commands via the uid parameter, a different vector than CVE-2008-2455. NOTE: it was later reported that 2.1.4 is also affected.

Affected products

n/a · n/a

public PoCs found — 4

cve_referencewww.exploit-db.com/exploits/6856unverified cve_referencewww.exploit-db.com/exploits/5666unverified cve_referencewww.exploit-db.com/exploits/6346unverified exploitdbwww.exploit-db.com/exploits/6158unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://osvdb.org/51408 http://secunia.com/advisories/30212 https://exchange.xforce.ibmcloud.com/vulnerabilities/42715 https://www.exploit-db.com/exploits/5666 https://www.exploit-db.com/exploits/6346 https://www.exploit-db.com/exploits/6856 http://www.securityfocus.com/archive/1/492506/100/0/threaded http://www.securityfocus.com/bid/29344 http://www.vupen.com/english/advisories/2008/2468