medium6.8Public exploit code
CVE-2008-6100
Multiple SQL injection vulnerabilities in Discussion Forums 2k 3.3, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Discussion Forums 2k 3.3 - Multiple SQL Injections2008-10-01 · webapps · php · Verified
Impact
Multiple SQL injection vulnerabilities in Discussion Forums 2k 3.3, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) CatID parameter to (a) RSS1.php and (b) RSS2.php in misc/; and the (2) SubID parameter to (c) misc/RSS5.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Berlios | Discussion Forum 2k | Version 3.3 |