CVE-2008-1895: SQL Injection
First published: Fri Apr 18 2008(Updated: )
Multiple SQL injection vulnerabilities in Carbon Communities 2.4 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) ID parameter to events.asp, the (2) UserName parameter to getpassword.asp, and possibly an unspecified parameter to (3) option_Update.asp in an edit action.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Invision Community | <=2.4 | |
| Invision Community | =1.0 | |
| Invision Community | =1.1 | |
| Invision Community | =2.1 | |
| Invision Community | =2.2 | |
| Invision Community | =2.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://bugreport.ir/index.php?/35
- http://bugreport.ir/index.php?/35/exploit
- http://www.securityfocus.com/bid/28806
- http://secunia.com/advisories/29827
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41845
- https://www.exploit-db.com/exploits/5456
- http://www.securityfocus.com/archive/1/490923/100/0/threaded
Frequently Asked Questions
What types of SQL injection vulnerabilities are present in CVE-2008-1895?
CVE-2008-1895 contains multiple SQL injection vulnerabilities that affect the ID, UserName, and possibly other parameters in several ASP pages.
What are the affected versions of Carbon Communities regarding CVE-2008-1895?
CVE-2008-1895 affects Carbon Communities versions 2.4 and earlier.
What could a remote attacker achieve by exploiting CVE-2008-1895?
By exploiting CVE-2008-1895, a remote attacker could execute arbitrary SQL commands against the database.
How can I protect my application from CVE-2008-1895?
To protect against CVE-2008-1895, ensure you update to the latest version of Carbon Communities and implement proper input validation.
Is there any patch available for CVE-2008-1895?
Yes, users should upgrade to a version of Carbon Communities later than 2.4 to mitigate the vulnerabilities outlined in CVE-2008-1895.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/last-modified-date
- agent/references
- agent/severity
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/weakness
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-historical
- vendor/carboncommunities
- canonical/invision community
- version/invision community/2.4
- version/invision community/1.0
- version/invision community/1.1
- version/invision community/2.1
- version/invision community/2.2
- version/invision community/2.3