{"api_version":"1","generated_at":"2026-07-23T08:44:04+00:00","cve":"CVE-2008-1895","urls":{"html":"https://cve.report/CVE-2008-1895","api":"https://cve.report/api/cve/CVE-2008-1895.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2008-1895","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2008-1895"},"summary":{"title":"CVE-2008-1895","description":"Multiple SQL injection vulnerabilities in Carbon Communities 2.4 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) ID parameter to events.asp, the (2) UserName parameter to getpassword.asp, and possibly an unspecified parameter to (3) option_Update.asp in an edit action.","state":"PUBLISHED","assigner":"mitre","published_at":"2008-04-18 22:05:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-89","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://www.securityfocus.com/archive/1/490923/100/0/threaded","name":"http://www.securityfocus.com/archive/1/490923/100/0/threaded","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://bugreport.ir/index.php?/35","name":"http://bugreport.ir/index.php?/35","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"Carbon Communities forum Multiple Vulnerabilities.","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/41845","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/41845","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.exploit-db.com/exploits/5456","name":"https://www.exploit-db.com/exploits/5456","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"carbon communities <= 2.4 - Multiple Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/28806","name":"http://www.securityfocus.com/bid/28806","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"Carbon Communities Multiple SQL Injection and Cross-Site Scripting Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://bugreport.ir/index.php?/35/exploit","name":"http://bugreport.ir/index.php?/35/exploit","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"BugReport.ir - Security Advisory - Vulnerabilities","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://secunia.com/advisories/29827","name":"http://secunia.com/advisories/29827","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Carbon Communities Cross-Site Scripting and SQL Injection - Secunia Advisories - Vulnerability Intelligence - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2008-1895","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-1895","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2008","cve_id":"1895","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"carboncommunities","cpe5":"carbon_communities","cpe6":"1.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"1895","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"carboncommunities","cpe5":"carbon_communities","cpe6":"1.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"1895","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"carboncommunities","cpe5":"carbon_communities","cpe6":"2.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"1895","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"carboncommunities","cpe5":"carbon_communities","cpe6":"2.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"1895","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"carboncommunities","cpe5":"carbon_communities","cpe6":"2.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"1895","vulnerable":"1","versionEndIncluding":"2.4","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"carboncommunities","cpe5":"carbon_communities","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T08:40:59.886Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_MISC","x_transferred"],"url":"http://bugreport.ir/index.php?/35"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://bugreport.ir/index.php?/35/exploit"},{"name":"29827","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/29827"},{"name":"20080416 Carbon Communities forum Multiple Vulnerabilities.","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/490923/100/0/threaded"},{"name":"28806","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/28806"},{"name":"5456","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"],"url":"https://www.exploit-db.com/exploits/5456"},{"name":"carboncommunities-id-sql-injection(41845)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/41845"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2008-04-16T00:00:00.000Z","descriptions":[{"lang":"en","value":"Multiple SQL injection vulnerabilities in Carbon Communities 2.4 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) ID parameter to events.asp, the (2) UserName parameter to getpassword.asp, and possibly an unspecified parameter to (3) option_Update.asp in an edit action."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2018-10-11T19:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"tags":["x_refsource_MISC"],"url":"http://bugreport.ir/index.php?/35"},{"tags":["x_refsource_MISC"],"url":"http://bugreport.ir/index.php?/35/exploit"},{"name":"29827","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/29827"},{"name":"20080416 Carbon Communities forum Multiple Vulnerabilities.","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/490923/100/0/threaded"},{"name":"28806","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/28806"},{"name":"5456","tags":["exploit","x_refsource_EXPLOIT-DB"],"url":"https://www.exploit-db.com/exploits/5456"},{"name":"carboncommunities-id-sql-injection(41845)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/41845"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2008-1895","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple SQL injection vulnerabilities in Carbon Communities 2.4 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) ID parameter to events.asp, the (2) UserName parameter to getpassword.asp, and possibly an unspecified parameter to (3) option_Update.asp in an edit action."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"http://bugreport.ir/index.php?/35","refsource":"MISC","url":"http://bugreport.ir/index.php?/35"},{"name":"http://bugreport.ir/index.php?/35/exploit","refsource":"MISC","url":"http://bugreport.ir/index.php?/35/exploit"},{"name":"29827","refsource":"SECUNIA","url":"http://secunia.com/advisories/29827"},{"name":"20080416 Carbon Communities forum Multiple Vulnerabilities.","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/490923/100/0/threaded"},{"name":"28806","refsource":"BID","url":"http://www.securityfocus.com/bid/28806"},{"name":"5456","refsource":"EXPLOIT-DB","url":"https://www.exploit-db.com/exploits/5456"},{"name":"carboncommunities-id-sql-injection(41845)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/41845"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2008-1895","datePublished":"2008-04-18T22:00:00.000Z","dateReserved":"2008-04-18T00:00:00.000Z","dateUpdated":"2024-08-07T08:40:59.886Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2008-04-18 22:05:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-89","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:carboncommunities:carbon_communities:*:*:*:*:*:*:*:*","versionEndIncluding":"2.4","matchCriteriaId":"22855354-0D9B-4594-9F2B-716067F72B85"},{"vulnerable":true,"criteria":"cpe:2.3:a:carboncommunities:carbon_communities:1.0:*:*:*:*:*:*:*","matchCriteriaId":"988F6660-AABE-47C2-A909-E6E91247D440"},{"vulnerable":true,"criteria":"cpe:2.3:a:carboncommunities:carbon_communities:1.1:*:*:*:*:*:*:*","matchCriteriaId":"7DE160C1-EDAE-49C5-B2EB-1FB2D7CA634A"},{"vulnerable":true,"criteria":"cpe:2.3:a:carboncommunities:carbon_communities:2.1:*:*:*:*:*:*:*","matchCriteriaId":"4D9BEEAC-649E-4DE2-B444-5AF30BAC46DE"},{"vulnerable":true,"criteria":"cpe:2.3:a:carboncommunities:carbon_communities:2.2:*:*:*:*:*:*:*","matchCriteriaId":"DD750FD5-2D87-47D6-A624-77DFD9FCB99A"},{"vulnerable":true,"criteria":"cpe:2.3:a:carboncommunities:carbon_communities:2.3:*:*:*:*:*:*:*","matchCriteriaId":"61BD9636-04CB-408B-BE62-8161BD171E24"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2008","CveId":"1895","Ordinal":"1","Title":"CVE-2008-1895","CVE":"CVE-2008-1895","Year":"2008"},"notes":[{"CveYear":"2008","CveId":"1895","Ordinal":"1","NoteData":"Multiple SQL injection vulnerabilities in Carbon Communities 2.4 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) ID parameter to events.asp, the (2) UserName parameter to getpassword.asp, and possibly an unspecified parameter to (3) option_Update.asp in an edit action.","Type":"Description","Title":"CVE-2008-1895"},{"CveYear":"2008","CveId":"1895","Ordinal":"2","NoteData":"2008-04-18","Type":"Other","Title":"Published"},{"CveYear":"2008","CveId":"1895","Ordinal":"3","NoteData":"2018-10-11","Type":"Other","Title":"Modified"}]}}}