Unscored severity · published May 9, 2008
CVE-2008-2125
SQL injection vulnerability in viewalbums.php in Musicbox 2.3.6 and 2.3.7 allows remote attackers to execute arbitrary SQL commands via the artistId parameter
–
CVSS
1%
EPSS
No
On KEV
Description
SQL injection vulnerability in viewalbums.php in Musicbox 2.3.6 and 2.3.7 allows remote attackers to execute arbitrary SQL commands via the artistId parameter.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 62% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MU
Musicbox · Musicbox
2.3.6; 2.3.7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-2125
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-2125
Vendor Advisory
http://secunia.com/advisories/30107
Exploit
http://www.securityfocus.com/bid/29100
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/42259
www.exploit-db.com
https://www.exploit-db.com/exploits/5560
More from Musicbox
–
CVE-2006-3882
Shalwan MusicBox 2.3.4 and earlier allows remote attackers to obtain configuration information via a direct request to phpinfo.php, which calls the phpinfo function
–
CVE-2006-3881
Cross-site scripting (XSS) vulnerability in Shalwan MusicBox 2.3.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the id parameter in a request for…
–
CVE-2006-3886
SQL injection vulnerability in Shalwan MusicBox 2.3.4 and earlier allows remote attackers to execute arbitrary SQL commands via the page parameter in a viewgallery action in a…
–
CVE-2006-1807
Multiple SQL injection vulnerabilities in index.php in Musicbox 2.3.3 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) start parameter in a search…
–
CVE-2006-1806
Cross-site scripting (XSS) vulnerability in index.php in Musicbox 2.3.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the term parameter in a…