CVE-2008-3768

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2008-08-22 · updated 2026-06-16
Weakness: CWE-89

Description

Multiple SQL injection vulnerabilities in class.ajax.php in Turnkey Web Tools SunShop Shopping Cart before 4.1.5 allow remote attackers to execute arbitrary SQL commands via (1) the id parameter in an edit_registry action to index.php, (2) a vector involving the check_email function, and other vectors.

Affected products

Turnkeywebtools Sunshop Shopping Cart: through 4.1.4; 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.5 (+8)

References

http://demos.turnkeywebtools.com/ss4/docs/change_log.txt
http://secunia.com/advisories/31539
http://securityreason.com/securityalert/4180
http://www.gulftech.org/?node=research&article_id=00125-08182008
http://www.securityfocus.com/archive/1/495578/100/0/threaded
http://www.securityfocus.com/bid/30751
https://exchange.xforce.ibmcloud.com/vulnerabilities/44553
https://www.exploit-db.com/exploits/6273
http://demos.turnkeywebtools.com/ss4/docs/change_log.txt
http://secunia.com/advisories/31539
http://securityreason.com/securityalert/4180
http://www.gulftech.org/?node=research&article_id=00125-08182008

Get alerted when CVE-2008-3768 or the next vulnerability affects your stack