CVE-2008-0428: SQL Injection

Published Jan 23, 2008

Updated

Multiple SQL injection vulnerabilities in the login function in system/classpermissions.php in bloofoxCMS 0.3 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameter to admin/index.php.

Affected Software

1 affected component

BloofoxCMS BloofoxCMS=0.3

Event History

Jan 23, 2008

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Frequently Asked Questions

What are the SQL injection vulnerabilities in CVE-2008-0428?

CVE-2008-0428 details multiple SQL injection vulnerabilities in the login function of bloofoxCMS 0.3, specifically via the username and password parameters.

What is the impact of CVE-2008-0428?

The impact of CVE-2008-0428 allows remote attackers to execute arbitrary SQL commands, potentially compromising the integrity of the database.

How do I fix CVE-2008-0428?

To fix CVE-2008-0428, it is recommended to implement input validation and parameterized queries in the login function to prevent SQL injection.

Which version of bloofoxCMS is affected by CVE-2008-0428?

BloofoxCMS version 0.3 is the only affected version for the vulnerabilities described in CVE-2008-0428.

Can CVE-2008-0428 be exploited without authentication?

Yes, CVE-2008-0428 can be exploited by remote attackers without requiring authentication, as it targets the login function directly.