VulnerabilityModified
CVE-2008-6725
Multiple SQL injection vulnerabilities in CMScout 2.06 allow remote authenticated users to execute arbitrary SQL commands via the id parameter to (1) index.php in a mythings page (mythings.php) and (2) the users page in admin.php.
MEDIUM 6.0EPSS 0.95%
Does this matter?
Lower severity and a low EPSS score (0.95%). Track it; it rarely justifies an emergency change on its own.
Description
Multiple SQL injection vulnerabilities in CMScout 2.06 allow remote authenticated users to execute arbitrary SQL commands via the id parameter to (1) index.php in a mythings page (mythings.php) and (2) the users page in admin.php.
- CVSS 2.0
- 6.0 MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:P
- EPSS
- 0.95% probability · 59th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-89
- Affected
- cmscout/cmscout
- Source
- cve@mitre.org
References
- http://osvdb.org/51118Exploit
- http://secunia.com/advisories/33375Vendor Advisory
- http://www.cmscout.co.za/index.php?page=news&id=30
- http://www.securityfocus.com/bid/33068Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/47659
- https://www.exploit-db.com/exploits/7625
- http://osvdb.org/51118Exploit
- http://secunia.com/advisories/33375Vendor Advisory
- http://www.cmscout.co.za/index.php?page=news&id=30
- http://www.securityfocus.com/bid/33068Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/47659
- https://www.exploit-db.com/exploits/7625
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.