high7.5Public exploit code
CVE-2008-6475
SQL injection vulnerability in the guestbook component (components/guestbook/guestbook.php) in Drake CMS 0.4.11 and earlier allows remote attackers to execute …
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Drake CMS 0.4.11 - Blind SQL Injection2008-04-07 · webapps · php · Verified
Impact
SQL injection vulnerability in the guestbook component (components/guestbook/guestbook.php) in Drake CMS 0.4.11 and earlier allows remote attackers to execute arbitrary SQL commands via the Via HTTP header (HTTP_VIA) to index.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Drake Team | Drake Cms | through 0.2.2.846 through 0.2.2_alpha_rev.846 through 0.3.2 through 0.3.3 through 0.3.4b through 0.3.5 |