Vulnerability Details CVE-2008-3591
SQL injection vulnerability in lib/class.admin.php in Twentyone Degrees Symphony 1.7.01 and earlier allows remote attackers to execute arbitrary SQL commands via the sym_auth cookie in a /publish/filemanager/ request to index.php.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 47.9%
CVSS Severity
CVSS v2 Score 7.5
References
- http://overture21.com/forum/comments.php?DiscussionID=1823
- http://secunia.com/advisories/31293
- http://securityreason.com/securityalert/4137
- http://www.securityfocus.com/bid/30477
- https://www.exploit-db.com/exploits/6177
- http://overture21.com/forum/comments.php?DiscussionID=1823
- http://secunia.com/advisories/31293
- http://securityreason.com/securityalert/4137
- http://www.securityfocus.com/bid/30477
- https://www.exploit-db.com/exploits/6177
Products affected by CVE-2008-3591
-
cpe:2.3:a:21degrees:symphony:*
-
cpe:2.3:a:21degrees:symphony:1.1
-
cpe:2.3:a:21degrees:symphony:1.5
-
cpe:2.3:a:21degrees:symphony:1.5.05
-
cpe:2.3:a:21degrees:symphony:1.5.06
-
cpe:2.3:a:21degrees:symphony:1.6.02
-
cpe:2.3:a:21degrees:symphony:1.7