CVE-2008-4178

Published: Sep 23, 2008Modified: Apr 23, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

SQL injection vulnerability in tr.php in DownlineGoldmine Special Category Addon, Downline Builder Pro, New Addon, and Downline Goldmine Builder allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: some of these details are obtained from third party information.

Affected (5)

Products: Downline Goldmine: Builder, New Addon

Downline Goldmine

2 products

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Downline Goldmine Builder	All versions
Downline Goldmine Builder	Version special_category_addon
Downline Goldmine Builder	Version unknown unknown
Downline Goldmine New Addon	All versions
Downline Goldmine New Addon	Version pro

Related CWEs

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

References (28)

http://packetstorm.linuxsecurity.com/0809-exploits/categoryaddon-sql.txt

Source: cve@mitre.org

http://packetstorm.linuxsecurity.com/0809-exploits/downline-sql.txt

Source: cve@mitre.org

Exploit

http://packetstormsecurity.org/0809-exploits/newdownline-sql.txt

Source: cve@mitre.org

Exploit

http://secunia.com/advisories/31812

Source: cve@mitre.org

Vendor Advisory

http://www.securityfocus.com/bid/31169

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2008/2992

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2008/2993

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2008/2994

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2008/2995

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/45128

Source: cve@mitre.org

https://www.exploit-db.com/exploits/6946

Source: cve@mitre.org

https://www.exploit-db.com/exploits/6947

Source: cve@mitre.org

https://www.exploit-db.com/exploits/6950

Source: cve@mitre.org

https://www.exploit-db.com/exploits/6951

Source: cve@mitre.org

http://packetstorm.linuxsecurity.com/0809-exploits/categoryaddon-sql.txt

Source: af854a3a-2127-422b-91ae-364da2661108

http://packetstorm.linuxsecurity.com/0809-exploits/downline-sql.txt

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://packetstormsecurity.org/0809-exploits/newdownline-sql.txt

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://secunia.com/advisories/31812

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.securityfocus.com/bid/31169

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2008/2992

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2008/2993

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2008/2994

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2008/2995

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/45128

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.exploit-db.com/exploits/6946

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.exploit-db.com/exploits/6947

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.exploit-db.com/exploits/6950

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.exploit-db.com/exploits/6951

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.