CVE-2008-6475

published 2009-03-16

CVE-2008-6475: SQL injection vulnerability in the guestbook component (components/guestbook/guestbook.php) in Drake CMS 0.4.11 and earlier allows remote attackers to execute…

Priority P3 42 high 7.5 CVSS 2.0

AV N AC L Au N C P I P A P

EXPLOIT

SQL injection vulnerability in the guestbook component (components/guestbook/guestbook.php) in Drake CMS 0.4.11 and earlier allows remote attackers to execute arbitrary SQL commands via the Via HTTP header (HTTP_VIA) to index.php.

Affected

17 ranges

Vendor	Product	Version range	Fixed in
drake_team	drake_cms	<= 0.2.2.846	—
drake_team	drake_cms	<= 0.2.2_alpha_rev.846	—
drake_team	drake_cms	<= 0.3.2	—
drake_team	drake_cms	<= 0.3.3	—
drake_team	drake_cms	<= 0.3.4b	—
drake_team	drake_cms	<= 0.3.5	—
drake_team	drake_cms	<= 0.3.6	—
drake_team	drake_cms	<= 0.3.7	—
drake_team	drake_cms	<= 0.3.7_beta	—
drake_team	drake_cms	<= 0.3.8_beta	—
drake_team	drake_cms	<= 0.3.9	—
drake_team	drake_cms	<= 0.4.0	—
drake_team	drake_cms	<= 0.4.0b	—
drake_team	drake_cms	<= 0.4.1	—
drake_team	drake_cms	<= 0.4.10_rc6	—
drake_team	drake_cms	<= 0.4.11	—
drake_team	drake_cms	—	—

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89