CVE-2008-3788 EXPLOIT
6.8
MEDIUM · CVSS 2.0 · EPSS 1.1% (pctl 64)
Patch early
A public exploit exists.
Description
Multiple SQL injection vulnerabilities in PICTURESPRO Photo Cart 3.9, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) qtitle, (2) qid, and (3) qyear parameters to (a) search.php, and the (4) email and (5) password parameters to (b) _login.php.
Scoring
| CVSS | 6.8 (MEDIUM, v2.0) |
|---|---|
| Vector | AV:N/AC:M/Au:N/C:P/I:P/A:P |
| EPSS | 1.08% — more likely to be exploited than 64% of all CVEs |
| Weakness | CWE-89 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2008-08-26 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| picturespro | picturespro photo cart |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Photocart 3.9 - Multiple SQL Injections | 2008-08-21 |
References
- http://packetstormsecurity.org/0808-exploits/photocart-sql.txt
- http://securityreason.com/securityalert/4188
- http://www.securityfocus.com/bid/30786
- https://exchange.xforce.ibmcloud.com/vulnerabilities/44607
- https://www.exploit-db.com/exploits/6285
- http://packetstormsecurity.org/0808-exploits/photocart-sql.txt
- http://securityreason.com/securityalert/4188
- http://www.securityfocus.com/bid/30786
- https://exchange.xforce.ibmcloud.com/vulnerabilities/44607
- https://www.exploit-db.com/exploits/6285
→ the Explorer · watch your stack · NVD