CVE-2008-5335: SQL Injection
SQL injection vulnerability in messages.php in PHP-Fusion 6.01.15 and 7.00.1, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the subject and msgsend parameters, a different vector than CVE-2005-3157, CVE-2005-3158, CVE-2005-3159, CVE-2005-4005, and CVE-2006-2459.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2008-5335?
CVE-2008-5335 is considered a high severity vulnerability due to its potential for remote SQL injection attacks.
How do I fix CVE-2008-5335?
To fix CVE-2008-5335, upgrade to a version of PHP-Fusion that is not affected, specifically versions later than 7.00.1.
What software versions are affected by CVE-2008-5335?
CVE-2008-5335 affects PHP-Fusion versions 6.01.15 and 7.00.1 when magic_quotes_gpc is disabled.
Can CVE-2008-5335 be exploited remotely?
Yes, CVE-2008-5335 can be exploited remotely by attackers who can send crafted requests to the vulnerable application.
What type of attack can CVE-2008-5335 lead to?
CVE-2008-5335 can lead to arbitrary SQL command execution on the database, potentially compromising the application and its data.