CVE-2008-2629: SQL Injection
Published Jun 10, 2008
·Updated
SQL injection vulnerability in the LifeType (formerly pLog) module for Drupal allows remote attackers to execute arbitrary SQL commands via the albumId parameter in a ViewAlbum action to index.php.
Affected Software
2 affected components
Drupal Drupal
Lifetype LifeType
Event History
Jun 10, 2008
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
12:32 AM
DescriptionWeaknessAffected Software
Frequently Asked Questions
1
Who can exploit this issue?
A remote attacker can exploit it over the network without authentication. The vulnerable input is the albumId parameter used in a ViewAlbum action to index.php.
2
What impact could successful exploitation have?
Successful exploitation allows execution of arbitrary SQL commands. The provided severity vector indicates potential impact to confidentiality, integrity, and availability.