{"api_version":"1","generated_at":"2026-07-23T10:18:25+00:00","cve":"CVE-2008-2843","urls":{"html":"https://cve.report/CVE-2008-2843","api":"https://cve.report/api/cve/CVE-2008-2843.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2008-2843","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2008-2843"},"summary":{"title":"CVE-2008-2843","description":"Multiple SQL injection vulnerabilities in doITLive CMS 2.50 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) ID parameter in an USUB action to default.asp and the (2) Licence[SpecialLicenseNumber] (aka LicenceId) cookie to edit/default.asp.","state":"PUBLISHED","assigner":"mitre","published_at":"2008-06-25 12:36:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-89","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/43161","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/43161","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/43163","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/43163","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/30705","name":"http://secunia.com/advisories/30705","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"doITLive CMS Cross-Site Scripting and SQL Injection Vulnerabilities - Secunia Advisories - Vulnerability Intelligence - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/29789","name":"http://www.securityfocus.com/bid/29789","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"doITlive CMS Multiple SQL Injection and Cross-Site Scripting Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.bugreport.ir/?/43","name":"http://www.bugreport.ir/?/43","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"BugReport.ir - Security Advisory - Vulnerabilities","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"https://www.exploit-db.com/exploits/5849","name":"https://www.exploit-db.com/exploits/5849","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"doITlive CMS <= 2.50 (SQL Injection/XSS) Multiple Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2008-2843","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-2843","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2008","cve_id":"2843","vulnerable":"1","versionEndIncluding":"2.50","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"doitlive","cpe5":"cms","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T09:14:14.856Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"29789","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/29789"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.bugreport.ir/?/43"},{"name":"30705","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/30705"},{"name":"5849","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"],"url":"https://www.exploit-db.com/exploits/5849"},{"name":"doitlive-licence-sql-injection(43163)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/43163"},{"name":"doitlive-default-sql-injection(43161)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/43161"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2008-06-18T00:00:00.000Z","descriptions":[{"lang":"en","value":"Multiple SQL injection vulnerabilities in doITLive CMS 2.50 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) ID parameter in an USUB action to default.asp and the (2) Licence[SpecialLicenseNumber] (aka LicenceId) cookie to edit/default.asp."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-09-28T12:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"29789","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/29789"},{"tags":["x_refsource_MISC"],"url":"http://www.bugreport.ir/?/43"},{"name":"30705","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/30705"},{"name":"5849","tags":["exploit","x_refsource_EXPLOIT-DB"],"url":"https://www.exploit-db.com/exploits/5849"},{"name":"doitlive-licence-sql-injection(43163)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/43163"},{"name":"doitlive-default-sql-injection(43161)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/43161"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2008-2843","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple SQL injection vulnerabilities in doITLive CMS 2.50 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) ID parameter in an USUB action to default.asp and the (2) Licence[SpecialLicenseNumber] (aka LicenceId) cookie to edit/default.asp."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"29789","refsource":"BID","url":"http://www.securityfocus.com/bid/29789"},{"name":"http://www.bugreport.ir/?/43","refsource":"MISC","url":"http://www.bugreport.ir/?/43"},{"name":"30705","refsource":"SECUNIA","url":"http://secunia.com/advisories/30705"},{"name":"5849","refsource":"EXPLOIT-DB","url":"https://www.exploit-db.com/exploits/5849"},{"name":"doitlive-licence-sql-injection(43163)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/43163"},{"name":"doitlive-default-sql-injection(43161)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/43161"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2008-2843","datePublished":"2008-06-25T10:00:00.000Z","dateReserved":"2008-06-24T00:00:00.000Z","dateUpdated":"2024-08-07T09:14:14.856Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2008-06-25 12:36:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-89","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":true,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:doitlive:cms:*:*:*:*:*:*:*:*","versionEndIncluding":"2.50","matchCriteriaId":"CCE35991-2B67-42F0-8D96-50AB3DFE15EE"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2008","CveId":"2843","Ordinal":"1","Title":"CVE-2008-2843","CVE":"CVE-2008-2843","Year":"2008"},"notes":[{"CveYear":"2008","CveId":"2843","Ordinal":"1","NoteData":"Multiple SQL injection vulnerabilities in doITLive CMS 2.50 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) ID parameter in an USUB action to default.asp and the (2) Licence[SpecialLicenseNumber] (aka LicenceId) cookie to edit/default.asp.","Type":"Description","Title":"CVE-2008-2843"},{"CveYear":"2008","CveId":"2843","Ordinal":"2","NoteData":"2008-06-25","Type":"Other","Title":"Published"},{"CveYear":"2008","CveId":"2843","Ordinal":"3","NoteData":"2017-09-28","Type":"Other","Title":"Modified"}]}}}