CVE-2008-6100: SQL Injection
Multiple SQL injection vulnerabilities in Discussion Forums 2k 3.3, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) CatID parameter to (a) RSS1.php and (b) RSS2.php in misc/; and the (2) SubID parameter to (c) misc/RSS5.php.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Enable magic_quotes_gpc (set magic_quotes_gpc = On in php.ini or via your PHP configuration) to avoid the SQL injection conditions described for Discussion Forums 2k 3.3 when magic_quotes_gpc is disabled.
PHP magic_quotes_gpc = On
Event History
Frequently Asked Questions
What is the severity of CVE-2008-6100?
CVE-2008-6100 is considered a critical vulnerability due to its potential to allow remote attackers to execute arbitrary SQL commands.
How do I fix CVE-2008-6100?
To fix CVE-2008-6100, ensure that magic_quotes_gpc is enabled and consider updating to a patched version of Discussion Forums 2k.
What software is affected by CVE-2008-6100?
CVE-2008-6100 affects Discussion Forums 2k version 3.3 when magic_quotes_gpc is disabled.
Can CVE-2008-6100 lead to data breaches?
Yes, CVE-2008-6100 can potentially lead to data breaches by allowing attackers to manipulate SQL queries.
Is CVE-2008-6100 easy to exploit?
Yes, CVE-2008-6100 is relatively easy to exploit for attackers familiar with SQL injection techniques.