CVE-2008-6641 EXPLOIT
6.5
MEDIUM · CVSS 2.0 · EPSS 0.9% (pctl 57)
Patch early
A public exploit exists.
Description
Multiple SQL injection vulnerabilities in Shader TV (Beta) allow remote authenticated administrators to execute arbitrary SQL commands via the sid parameter to (1) kanal.asp, (2) google.asp, and (3) hakk.asp in yonet/; and allow remote attackers to execute arbitrary SQL commands via the (4) username or (5) password fields to yonet/default.asp.
Scoring
| CVSS | 6.5 (MEDIUM, v2.0) |
|---|---|
| Vector | AV:N/AC:L/Au:S/C:P/I:P/A:P |
| EPSS | 0.85% — more likely to be exploited than 57% of all CVEs |
| Weakness | CWE-89 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2009-04-07 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| aspindir | shader tv |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Shader TV (Beta) - Multiple SQL Injections | 2008-05-08 |
References
→ the Explorer · watch your stack · NVD