CVEvulnerability
CVE-2008-3788
6.8 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2008-08-26
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-89
Description
Multiple SQL injection vulnerabilities in PICTURESPRO Photo Cart 3.9, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) qtitle, (2) qid, and (3) qyear parameters to (a) search.php, and the (4) email and (5) password parameters to (b) _login.php.
Affected configurations
• picturespro picturespro photo cart 3.9
Related
Weakness · CWE (1)
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness
References
- http://packetstormsecurity.org/0808-exploits/photocart-sql.txt Exploit
- http://securityreason.com/securityalert/4188 securityreason.com
- http://www.securityfocus.com/bid/30786 Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/44607 exchange.xforce.ibmcloud.com
- https://www.exploit-db.com/exploits/6285 www.exploit-db.com
- http://packetstormsecurity.org/0808-exploits/photocart-sql.txt Exploit
- http://securityreason.com/securityalert/4188 securityreason.com
- http://www.securityfocus.com/bid/30786 Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/44607 exchange.xforce.ibmcloud.com
- https://www.exploit-db.com/exploits/6285 www.exploit-db.com