{"api_version":"1","generated_at":"2026-07-23T09:36:35+00:00","cve":"CVE-2008-1272","urls":{"html":"https://cve.report/CVE-2008-1272","api":"https://cve.report/api/cve/CVE-2008-1272.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2008-1272","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2008-1272"},"summary":{"title":"CVE-2008-1272","description":"Multiple SQL injection vulnerabilities in BM Classifieds 20080309 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) cat parameter to showad.php and the (2) ad parameter to pfriendly.php.","state":"PUBLISHED","assigner":"mitre","published_at":"2008-03-10 23:44:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-89","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://secunia.com/advisories/29297","name":"http://secunia.com/advisories/29297","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"BM Classifieds Two SQL Injection Vulnerabilities - Advisories - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/28159","name":"http://www.securityfocus.com/bid/28159","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Batchelor Media BM Classifieds Multiple SQL Injection Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/41066","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/41066","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.exploit-db.com/exploits/5223","name":"https://www.exploit-db.com/exploits/5223","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"BM Classifieds <= 20080409 Multiple SQL Injection Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2008-1272","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-1272","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2008","cve_id":"1272","vulnerable":"1","versionEndIncluding":"20080309","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"bmscripts","cpe5":"bm_classifieds","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T08:17:34.350Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"28159","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/28159"},{"name":"5223","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"],"url":"https://www.exploit-db.com/exploits/5223"},{"name":"29297","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/29297"},{"name":"bmclassifieds-showad-sql-injection(41066)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/41066"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2008-03-09T00:00:00.000Z","descriptions":[{"lang":"en","value":"Multiple SQL injection vulnerabilities in BM Classifieds 20080309 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) cat parameter to showad.php and the (2) ad parameter to pfriendly.php."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-09-28T12:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"28159","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/28159"},{"name":"5223","tags":["exploit","x_refsource_EXPLOIT-DB"],"url":"https://www.exploit-db.com/exploits/5223"},{"name":"29297","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/29297"},{"name":"bmclassifieds-showad-sql-injection(41066)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/41066"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2008-1272","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple SQL injection vulnerabilities in BM Classifieds 20080309 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) cat parameter to showad.php and the (2) ad parameter to pfriendly.php."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"28159","refsource":"BID","url":"http://www.securityfocus.com/bid/28159"},{"name":"5223","refsource":"EXPLOIT-DB","url":"https://www.exploit-db.com/exploits/5223"},{"name":"29297","refsource":"SECUNIA","url":"http://secunia.com/advisories/29297"},{"name":"bmclassifieds-showad-sql-injection(41066)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/41066"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2008-1272","datePublished":"2008-03-10T23:00:00.000Z","dateReserved":"2008-03-10T00:00:00.000Z","dateUpdated":"2024-08-07T08:17:34.350Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2008-03-10 23:44:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-89","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":true,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:bmscripts:bm_classifieds:*:*:*:*:*:*:*:*","versionEndIncluding":"20080309","matchCriteriaId":"527EE0A4-8AA2-4113-BE76-0430A06E36B3"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2008","CveId":"1272","Ordinal":"1","Title":"CVE-2008-1272","CVE":"CVE-2008-1272","Year":"2008"},"notes":[{"CveYear":"2008","CveId":"1272","Ordinal":"1","NoteData":"Multiple SQL injection vulnerabilities in BM Classifieds 20080309 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) cat parameter to showad.php and the (2) ad parameter to pfriendly.php.","Type":"Description","Title":"CVE-2008-1272"},{"CveYear":"2008","CveId":"1272","Ordinal":"2","NoteData":"2008-03-10","Type":"Other","Title":"Published"},{"CveYear":"2008","CveId":"1272","Ordinal":"3","NoteData":"2017-09-28","Type":"Other","Title":"Modified"}]}}}