Unscored severity · published Mar 23, 2009
CVE-2008-6509
SQL injection vulnerability in CallLogDAO in SIP Plugin in Openfire 3.6.0a and earlier allows remote attackers to execute arbitrary SQL commands via the type parameter to…
–
CVSS
2%
EPSS
No
On KEV
Description
SQL injection vulnerability in CallLogDAO in SIP Plugin in Openfire 3.6.0a and earlier allows remote attackers to execute arbitrary SQL commands via the type parameter to sipark-log-summary.jsp.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Openfire · Igniterealtime
through 3.6.0a; 2.6.0; 2.6.1; 2.6.2; 3.0.0; 3.0.1; +19 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-6509
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-6509
osvdb.org
http://osvdb.org/51912
secunia.com
http://secunia.com/advisories/32478
www.andreas-kurtz.de
http://www.andreas-kurtz.de/advisories/AKADV2008-001-v1.0.txt
Exploit
http://www.andreas-kurtz.de/archives/63
www.igniterealtime.org
http://www.igniterealtime.org/issues/browse/JM-1488
www.securityfocus.com
http://www.securityfocus.com/archive/1/498162/100/0/threaded
More from Openfire
7.5
CVE-2023-32315
Openfire administration console authentication bypass
9.8
CVE-2024-25421
An issue in Ignite Realtime Openfire v.4.9.0 and before allows a remote attacker to escalate privileges via the ROOM_CACHE component
9.8
CVE-2021-45967
An issue was discovered in Pascom Cloud Phone System before 7.20.x
9.8
CVE-2019-18394
A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests
7.5
CVE-2014-3451
OpenFire XMPP Server before 3.10 accepts self-signed certificates, which allows remote attackers to perform unspecified spoofing attacks