Unscored severity · published Dec 17, 2008
CVE-2008-5609
SQL injection vulnerability in the Commerce extension 0.9.6 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors
–
CVSS
1.1%
EPSS
No
On KEV
Description
SQL injection vulnerability in the Commerce extension 0.9.6 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 64% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CE
Commerce Extension · Typo3
through 0.9.6; 0.8.32; 0.8.35; 0.9.0; 0.9.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-5609
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-5609
typo3.org
http://typo3.org/extensions/repository/view/commerce/0.9.7/
Vendor Advisory
http://typo3.org/teams/security/security-bulletins/typo3-20081020-2/
www.vupen.com
http://www.vupen.com/english/advisories/2008/2870
More from Commerce Extension
–
CVE-2009-4963
Cross-site scripting (XSS) vulnerability in the Commerce extension before 0.9.9 for TYPO3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified…