CVE-2008-1496

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2008-03-25 · updated 2026-06-16
Weakness: CWE-89

Description

Multiple SQL injection vulnerabilities in PEEL, possibly 3.x and earlier, allow remote attackers to execute arbitrary SQL commands via the (1) email parameter to (a) membre.php, and the (2) timestamp parameter to (b) the details action in achat/historique_commandes.php and (c) the facture action in factures/facture_html.php.

Affected products

Peel: 1.0b, 2.6, 2.7

References

http://realn.free.fr/releases/70207
http://secunia.com/advisories/29466
http://www.securityfocus.com/bid/28346
https://exchange.xforce.ibmcloud.com/vulnerabilities/41341
https://exchange.xforce.ibmcloud.com/vulnerabilities/41353
https://www.exploit-db.com/exploits/5281
http://realn.free.fr/releases/70207
http://secunia.com/advisories/29466
http://www.securityfocus.com/bid/28346
https://exchange.xforce.ibmcloud.com/vulnerabilities/41341
https://exchange.xforce.ibmcloud.com/vulnerabilities/41353
https://www.exploit-db.com/exploits/5281

Get alerted when CVE-2008-1496 or the next vulnerability affects your stack