CVE-2008-1895

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2008-04-18 · updated 2026-06-16
Weakness: CWE-89

Description

Multiple SQL injection vulnerabilities in Carbon Communities 2.4 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) ID parameter to events.asp, the (2) UserName parameter to getpassword.asp, and possibly an unspecified parameter to (3) option_Update.asp in an edit action.

Affected products

Carboncommunities Carbon Communities: through 2.4; 1.0, 1.1, 2.1, 2.2, 2.3

References

http://bugreport.ir/index.php?/35
http://bugreport.ir/index.php?/35/exploit
http://secunia.com/advisories/29827
http://www.securityfocus.com/archive/1/490923/100/0/threaded
http://www.securityfocus.com/bid/28806
https://exchange.xforce.ibmcloud.com/vulnerabilities/41845
https://www.exploit-db.com/exploits/5456
http://bugreport.ir/index.php?/35
http://bugreport.ir/index.php?/35/exploit
http://secunia.com/advisories/29827
http://www.securityfocus.com/archive/1/490923/100/0/threaded
http://www.securityfocus.com/bid/28806

Get alerted when CVE-2008-1895 or the next vulnerability affects your stack