CVE-2008-6069: SQL Injection
SQL injection vulnerability in e107chat.php in the eChat plugin 4.2 for e107, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the nick parameter.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Enable magic_quotes_gpc by setting magic_quotes_gpc = On in php.ini to mitigate the SQL injection vulnerability in eChat plugin 4.2 that occurs when magic_quotes_gpc is disabled (vulnerable via the nick parameter in e107chat.php).
PHP (php.ini) magic_quotes_gpc = On
Event History
Frequently Asked Questions
What is the severity of CVE-2008-6069?
CVE-2008-6069 is considered a high severity vulnerability due to the potential for remote attackers to execute arbitrary SQL commands.
How do I fix CVE-2008-6069?
To fix CVE-2008-6069, ensure that magic_quotes_gpc is enabled and consider upgrading to a patched version of the eChat plugin.
Which versions are affected by CVE-2008-6069?
CVE-2008-6069 specifically affects version 4.2 of the eChat plugin for e107.
What kind of vulnerability is CVE-2008-6069?
CVE-2008-6069 is an SQL injection vulnerability that allows attackers to manipulate database queries.
Can I use e107 CMS safely with CVE-2008-6069?
While e107 CMS itself is not vulnerable, using the eChat plugin version 4.2 poses security risks if it remains unpatched.