CVE-2008-3506

Published: Aug 6, 2008Modified: Apr 23, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

SQL injection vulnerability in PolyPager 1.0 rc2 and earlier allows remote attackers to execute arbitrary SQL commands via the nr parameter to the default URI.

Affected (9)

Products: Polypager: Polypager

1 product

Configuration A

9 vulnerable

Vulnerable Software	Affected Versions
Polypager Polypager	Up to 1.0
Polypager Polypager	Version 0.9.4
Polypager Polypager	Version 0.9.51
Polypager Polypager	Version 0.9.6
Polypager Polypager	Version 0.9.7
Polypager Polypager	Version 0.9.8
Polypager Polypager	Version 0.9.9
Polypager Polypager	Version 1.0
Polypager Polypager	Version 1.0 rc1

Related CWEs

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

References (8)

http://securityreason.com/securityalert/4116

Source: cve@mitre.org

http://www.securityfocus.com/bid/29972

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/43371

Source: cve@mitre.org

https://www.exploit-db.com/exploits/5941

Source: cve@mitre.org

http://securityreason.com/securityalert/4116

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/29972

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/43371

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.exploit-db.com/exploits/5941

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.