CVE-2008-1895: SQL Injection
Multiple SQL injection vulnerabilities in Carbon Communities 2.4 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) ID parameter to events.asp, the (2) UserName parameter to getpassword.asp, and possibly an unspecified parameter to (3) optionUpdate.asp in an edit action.
Affected Software
Event History
Frequently Asked Questions
What types of SQL injection vulnerabilities are present in CVE-2008-1895?
CVE-2008-1895 contains multiple SQL injection vulnerabilities that affect the ID, UserName, and possibly other parameters in several ASP pages.
What are the affected versions of Carbon Communities regarding CVE-2008-1895?
CVE-2008-1895 affects Carbon Communities versions 2.4 and earlier.
What could a remote attacker achieve by exploiting CVE-2008-1895?
By exploiting CVE-2008-1895, a remote attacker could execute arbitrary SQL commands against the database.
How can I protect my application from CVE-2008-1895?
To protect against CVE-2008-1895, ensure you update to the latest version of Carbon Communities and implement proper input validation.
Is there any patch available for CVE-2008-1895?
Yes, users should upgrade to a version of Carbon Communities later than 2.4 to mitigate the vulnerabilities outlined in CVE-2008-1895.