Unscored severity · published Apr 11, 2008
CVE-2008-1726
Multiple SQL injection vulnerabilities in KnowledgeQuest 2.6, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) kqid…
–
CVSS
1.6%
EPSS
No
On KEV
Description
Multiple SQL injection vulnerabilities in KnowledgeQuest 2.6, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) kqid parameter to (a) articletext.php and (b) articletextonly.php and the (2) username parameter to (c) logincheck.php.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KN
Knowledgequest · Myknowledgequest
2.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-1726
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-1726
Vendor Advisory
http://secunia.com/advisories/29716
www.osvdb.org
http://www.osvdb.org/44254
www.osvdb.org
http://www.osvdb.org/44255
www.osvdb.org
http://www.osvdb.org/44256
Exploit
http://www.securityfocus.com/bid/28713
Exploit
http://www.securityfocus.com/bid/28716
More from Knowledgequest
–
CVE-2008-1727
KnowledgeQuest 2.5 and 2.6 does not require authentication for access to admincheck.php, which allows remote attackers to create arbitrary admin accounts