{"api_version":"1","generated_at":"2026-07-23T11:56:42+00:00","cve":"CVE-2008-2862","urls":{"html":"https://cve.report/CVE-2008-2862","api":"https://cve.report/api/cve/CVE-2008-2862.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2008-2862","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2008-2862"},"summary":{"title":"CVE-2008-2862","description":"Multiple SQL injection vulnerabilities in eLineStudio Site Composer (ESC) 2.6 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to ansFAQ.asp and the (2) template_id parameter to preview.asp.","state":"PUBLISHED","assigner":"mitre","published_at":"2008-06-25 12:36:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-89","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://securityreason.com/securityalert/3957","name":"http://securityreason.com/securityalert/3957","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"eLineStudio Site Composer (ESC) <=2.6 Multiple Vulnerabilities - CXSecurity.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/archive/1/493473/100/0/threaded","name":"http://www.securityfocus.com/archive/1/493473/100/0/threaded","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/30762","name":"http://secunia.com/advisories/30762","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"eLineStudio Site Composer Multiple Vulnerabilities - Secunia Advisories - Vulnerability Intelligence - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/29812","name":"http://www.securityfocus.com/bid/29812","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"eLineStudio Site Composer Multiple Input Validation and Unauthorized Access Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.exploit-db.com/exploits/5859","name":"https://www.exploit-db.com/exploits/5859","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"eLineStudio Site Composer (ESC) 2.6 - Multiple Vulnerabilities - PHP webapps Exploit","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/43190","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/43190","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.bugreport.ir/?/45","name":"http://www.bugreport.ir/?/45","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"BugReport.ir - Security Advisory - Vulnerabilities","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://osvdb.org/46461","name":"http://osvdb.org/46461","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2008-2862","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-2862","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2008","cve_id":"2862","vulnerable":"1","versionEndIncluding":"2.6","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"elinestudio","cpe5":"site_composer","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T09:14:14.959Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"3957","tags":["third-party-advisory","x_refsource_SREASON","x_transferred"],"url":"http://securityreason.com/securityalert/3957"},{"name":"5859","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"],"url":"https://www.exploit-db.com/exploits/5859"},{"name":"46461","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/46461"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.bugreport.ir/?/45"},{"name":"29812","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/29812"},{"name":"esc-ansfaq-preview-sql-injection(43190)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/43190"},{"name":"20080619 eLineStudio Site Composer (ESC) <=2.6 Multiple Vulnerabilities","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/493473/100/0/threaded"},{"name":"30762","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/30762"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2008-06-19T00:00:00.000Z","descriptions":[{"lang":"en","value":"Multiple SQL injection vulnerabilities in eLineStudio Site Composer (ESC) 2.6 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to ansFAQ.asp and the (2) template_id parameter to preview.asp."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2018-10-11T19:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"3957","tags":["third-party-advisory","x_refsource_SREASON"],"url":"http://securityreason.com/securityalert/3957"},{"name":"5859","tags":["exploit","x_refsource_EXPLOIT-DB"],"url":"https://www.exploit-db.com/exploits/5859"},{"name":"46461","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/46461"},{"tags":["x_refsource_MISC"],"url":"http://www.bugreport.ir/?/45"},{"name":"29812","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/29812"},{"name":"esc-ansfaq-preview-sql-injection(43190)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/43190"},{"name":"20080619 eLineStudio Site Composer (ESC) <=2.6 Multiple Vulnerabilities","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/493473/100/0/threaded"},{"name":"30762","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/30762"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2008-2862","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple SQL injection vulnerabilities in eLineStudio Site Composer (ESC) 2.6 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to ansFAQ.asp and the (2) template_id parameter to preview.asp."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"3957","refsource":"SREASON","url":"http://securityreason.com/securityalert/3957"},{"name":"5859","refsource":"EXPLOIT-DB","url":"https://www.exploit-db.com/exploits/5859"},{"name":"46461","refsource":"OSVDB","url":"http://osvdb.org/46461"},{"name":"http://www.bugreport.ir/?/45","refsource":"MISC","url":"http://www.bugreport.ir/?/45"},{"name":"29812","refsource":"BID","url":"http://www.securityfocus.com/bid/29812"},{"name":"esc-ansfaq-preview-sql-injection(43190)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/43190"},{"name":"20080619 eLineStudio Site Composer (ESC) <=2.6 Multiple Vulnerabilities","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/493473/100/0/threaded"},{"name":"30762","refsource":"SECUNIA","url":"http://secunia.com/advisories/30762"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2008-2862","datePublished":"2008-06-25T10:00:00.000Z","dateReserved":"2008-06-24T00:00:00.000Z","dateUpdated":"2024-08-07T09:14:14.959Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2008-06-25 12:36:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-89","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":true,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:elinestudio:site_composer:*:*:*:*:*:*:*:*","versionEndIncluding":"2.6","matchCriteriaId":"F0FD8D51-A4F6-464D-93E3-1EA6C2C50A45"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2008","CveId":"2862","Ordinal":"1","Title":"CVE-2008-2862","CVE":"CVE-2008-2862","Year":"2008"},"notes":[{"CveYear":"2008","CveId":"2862","Ordinal":"1","NoteData":"Multiple SQL injection vulnerabilities in eLineStudio Site Composer (ESC) 2.6 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to ansFAQ.asp and the (2) template_id parameter to preview.asp.","Type":"Description","Title":"CVE-2008-2862"},{"CveYear":"2008","CveId":"2862","Ordinal":"2","NoteData":"2008-06-25","Type":"Other","Title":"Published"},{"CveYear":"2008","CveId":"2862","Ordinal":"3","NoteData":"2018-10-11","Type":"Other","Title":"Modified"}]}}}