CVE-2008-1895 EXPLOIT
7.5
HIGH · CVSS 2.0 · EPSS 1.2% (pctl 67)
Patch early
A public exploit exists.
Description
Multiple SQL injection vulnerabilities in Carbon Communities 2.4 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) ID parameter to events.asp, the (2) UserName parameter to getpassword.asp, and possibly an unspecified parameter to (3) option_Update.asp in an edit action.
Scoring
| CVSS | 7.5 (HIGH, v2.0) |
|---|---|
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| EPSS | 1.19% — more likely to be exploited than 67% of all CVEs |
| Weakness | CWE-89 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2008-04-18 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| carboncommunities | carbon communities |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Carbon Communities 2.4 - Multiple Vulnerabilities | 2008-04-16 |
References
- http://bugreport.ir/index.php?/35
- http://bugreport.ir/index.php?/35/exploit
- http://secunia.com/advisories/29827
- http://www.securityfocus.com/archive/1/490923/100/0/threaded
- http://www.securityfocus.com/bid/28806
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41845
- https://www.exploit-db.com/exploits/5456
- http://bugreport.ir/index.php?/35
- http://bugreport.ir/index.php?/35/exploit
- http://secunia.com/advisories/29827
- http://www.securityfocus.com/archive/1/490923/100/0/threaded
- http://www.securityfocus.com/bid/28806
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41845
- https://www.exploit-db.com/exploits/5456
→ the Explorer · watch your stack · NVD