CVE-2008-0652: SQL Injection

Published Feb 7, 2008

Updated

SQL injection vulnerability in index.php in the Downloads (comdownloads) component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the filecatid parameter in a selectfolder action.

Affected Software

2 affected components

Mambo Com Downloads

Joomla Com Downloads

Event History

Feb 7, 2008

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2008-0652?

CVE-2008-0652 has been classified with a medium severity level due to its potential for SQL injection exploits.

How do I fix CVE-2008-0652?

To fix CVE-2008-0652, update to the latest version of the Downloads component for either Mambo or Joomla! that addresses this vulnerability.

What software is affected by CVE-2008-0652?

CVE-2008-0652 affects the Downloads component (com_downloads) in both Mambo and Joomla! applications.

What type of attack can be executed due to CVE-2008-0652?

CVE-2008-0652 allows remote attackers to execute arbitrary SQL commands, leading to potential data compromise.

Is there a workaround for CVE-2008-0652 if I cannot update immediately?

A possible workaround for CVE-2008-0652 is to validate and sanitize input parameters to prevent SQL injection.