CVE-2008-5998: SQL Injection
Multiple SQL injection vulnerabilities in the ajaxchecklistsave function in the Ajax Checklist module 5.x before 5.x-1.1 for Drupal allow remote authenticated users, with "update ajax checklists" permissions, to execute arbitrary SQL commands via a save operation, related to the (1) nid, (2) qid, and (3) state parameters.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ajax Checklist moduleto a version that resolves this vulnerability.Fixed in 5.x-1.1
Event History
Frequently Asked Questions
What is the severity of CVE-2008-5998?
CVE-2008-5998 is considered a critical SQL injection vulnerability that allows remote authenticated users to execute arbitrary SQL commands.
How do I fix CVE-2008-5998?
To mitigate CVE-2008-5998, upgrade to the Ajax Checklist module version 5.x-1.1 or later.
What software is affected by CVE-2008-5998?
CVE-2008-5998 specifically affects the Ajax Checklist module version 5.x-1.0 for Drupal.
Who can exploit the CVE-2008-5998 vulnerability?
CVE-2008-5998 can be exploited by remote authenticated users who have the 'update ajax checklists' permissions.
What kind of attacks can occur due to CVE-2008-5998?
Exploitation of CVE-2008-5998 can lead to unauthorized execution of SQL commands, potentially compromising the database.