{"api_version":"1","generated_at":"2026-07-23T08:24:39+00:00","cve":"CVE-2008-4178","urls":{"html":"https://cve.report/CVE-2008-4178","api":"https://cve.report/api/cve/CVE-2008-4178.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2008-4178","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2008-4178"},"summary":{"title":"CVE-2008-4178","description":"SQL injection vulnerability in tr.php in DownlineGoldmine Special Category Addon, Downline Builder Pro, New Addon, and Downline Goldmine Builder allows remote attackers to execute arbitrary SQL commands via the id parameter.  NOTE: some of these details are obtained from third party information.","state":"PUBLISHED","assigner":"mitre","published_at":"2008-09-23 15:25:42","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-89","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://secunia.com/advisories/31812","name":"http://secunia.com/advisories/31812","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Downline Goldmine Builder \"id\" SQL Injection - Secunia Advisories - Vulnerability Intelligence - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/31169","name":"http://www.securityfocus.com/bid/31169","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"DownlineGoldmine Multiple Products 'tr.php' SQL Injection Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.exploit-db.com/exploits/6950","name":"https://www.exploit-db.com/exploits/6950","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Downline Goldmine paidversion - SQL Injection - PHP webapps Exploit","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2008/2992","name":"http://www.vupen.com/english/advisories/2008/2992","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://packetstormsecurity.org/0809-exploits/newdownline-sql.txt","name":"http://packetstormsecurity.org/0809-exploits/newdownline-sql.txt","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"Files ≈ Packet Storm","mime":"text/plain","httpstatus":"200","archivestatus":"200"},{"url":"https://www.exploit-db.com/exploits/6951","name":"https://www.exploit-db.com/exploits/6951","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Downline Goldmine newdownlinebuilder - SQL Injection - PHP webapps Exploit","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2008/2993","name":"http://www.vupen.com/english/advisories/2008/2993","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2008/2994","name":"http://www.vupen.com/english/advisories/2008/2994","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://packetstorm.linuxsecurity.com/0809-exploits/categoryaddon-sql.txt","name":"http://packetstorm.linuxsecurity.com/0809-exploits/categoryaddon-sql.txt","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"404"},{"url":"http://www.vupen.com/english/advisories/2008/2995","name":"http://www.vupen.com/english/advisories/2008/2995","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.exploit-db.com/exploits/6946","name":"https://www.exploit-db.com/exploits/6946","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Downline Goldmine Builder - SQL Injection - PHP webapps Exploit","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://packetstorm.linuxsecurity.com/0809-exploits/downline-sql.txt","name":"http://packetstorm.linuxsecurity.com/0809-exploits/downline-sql.txt","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"","mime":"","httpstatus":"-1","archivestatus":"404"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/45128","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/45128","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.exploit-db.com/exploits/6947","name":"https://www.exploit-db.com/exploits/6947","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Downline Goldmine Category Addon - SQL Injection - PHP webapps Exploit","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2008-4178","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-4178","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2008","cve_id":"4178","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"downline_goldmine","cpe5":"builder","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"4178","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"downline_goldmine","cpe5":"builder","cpe6":"special_category_addon","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"4178","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"downline_goldmine","cpe5":"builder","cpe6":"unknown","cpe7":"unknown","cpe8":"pro","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"4178","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"downline_goldmine","cpe5":"new_addon","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"4178","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"downline_goldmine","cpe5":"new_addon","cpe6":"pro","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T10:08:35.152Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"6947","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"],"url":"https://www.exploit-db.com/exploits/6947"},{"name":"ADV-2008-2993","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2008/2993"},{"name":"ADV-2008-2992","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2008/2992"},{"name":"downlinegoldmine-tr-sql-injection(45128)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/45128"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://packetstorm.linuxsecurity.com/0809-exploits/downline-sql.txt"},{"name":"31169","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/31169"},{"name":"6950","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"],"url":"https://www.exploit-db.com/exploits/6950"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://packetstorm.linuxsecurity.com/0809-exploits/categoryaddon-sql.txt"},{"name":"6951","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"],"url":"https://www.exploit-db.com/exploits/6951"},{"name":"ADV-2008-2995","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2008/2995"},{"name":"6946","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"],"url":"https://www.exploit-db.com/exploits/6946"},{"name":"31812","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/31812"},{"name":"ADV-2008-2994","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2008/2994"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://packetstormsecurity.org/0809-exploits/newdownline-sql.txt"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2008-09-16T00:00:00.000Z","descriptions":[{"lang":"en","value":"SQL injection vulnerability in tr.php in DownlineGoldmine Special Category Addon, Downline Builder Pro, New Addon, and Downline Goldmine Builder allows remote attackers to execute arbitrary SQL commands via the id parameter.  NOTE: some of these details are obtained from third party information."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-09-28T12:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"6947","tags":["exploit","x_refsource_EXPLOIT-DB"],"url":"https://www.exploit-db.com/exploits/6947"},{"name":"ADV-2008-2993","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2008/2993"},{"name":"ADV-2008-2992","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2008/2992"},{"name":"downlinegoldmine-tr-sql-injection(45128)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/45128"},{"tags":["x_refsource_MISC"],"url":"http://packetstorm.linuxsecurity.com/0809-exploits/downline-sql.txt"},{"name":"31169","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/31169"},{"name":"6950","tags":["exploit","x_refsource_EXPLOIT-DB"],"url":"https://www.exploit-db.com/exploits/6950"},{"tags":["x_refsource_MISC"],"url":"http://packetstorm.linuxsecurity.com/0809-exploits/categoryaddon-sql.txt"},{"name":"6951","tags":["exploit","x_refsource_EXPLOIT-DB"],"url":"https://www.exploit-db.com/exploits/6951"},{"name":"ADV-2008-2995","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2008/2995"},{"name":"6946","tags":["exploit","x_refsource_EXPLOIT-DB"],"url":"https://www.exploit-db.com/exploits/6946"},{"name":"31812","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/31812"},{"name":"ADV-2008-2994","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2008/2994"},{"tags":["x_refsource_MISC"],"url":"http://packetstormsecurity.org/0809-exploits/newdownline-sql.txt"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2008-4178","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"SQL injection vulnerability in tr.php in DownlineGoldmine Special Category Addon, Downline Builder Pro, New Addon, and Downline Goldmine Builder allows remote attackers to execute arbitrary SQL commands via the id parameter.  NOTE: some of these details are obtained from third party information."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"6947","refsource":"EXPLOIT-DB","url":"https://www.exploit-db.com/exploits/6947"},{"name":"ADV-2008-2993","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2008/2993"},{"name":"ADV-2008-2992","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2008/2992"},{"name":"downlinegoldmine-tr-sql-injection(45128)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/45128"},{"name":"http://packetstorm.linuxsecurity.com/0809-exploits/downline-sql.txt","refsource":"MISC","url":"http://packetstorm.linuxsecurity.com/0809-exploits/downline-sql.txt"},{"name":"31169","refsource":"BID","url":"http://www.securityfocus.com/bid/31169"},{"name":"6950","refsource":"EXPLOIT-DB","url":"https://www.exploit-db.com/exploits/6950"},{"name":"http://packetstorm.linuxsecurity.com/0809-exploits/categoryaddon-sql.txt","refsource":"MISC","url":"http://packetstorm.linuxsecurity.com/0809-exploits/categoryaddon-sql.txt"},{"name":"6951","refsource":"EXPLOIT-DB","url":"https://www.exploit-db.com/exploits/6951"},{"name":"ADV-2008-2995","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2008/2995"},{"name":"6946","refsource":"EXPLOIT-DB","url":"https://www.exploit-db.com/exploits/6946"},{"name":"31812","refsource":"SECUNIA","url":"http://secunia.com/advisories/31812"},{"name":"ADV-2008-2994","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2008/2994"},{"name":"http://packetstormsecurity.org/0809-exploits/newdownline-sql.txt","refsource":"MISC","url":"http://packetstormsecurity.org/0809-exploits/newdownline-sql.txt"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2008-4178","datePublished":"2008-09-23T15:00:00.000Z","dateReserved":"2008-09-23T00:00:00.000Z","dateUpdated":"2024-08-07T10:08:35.152Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2008-09-23 15:25:42","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-89","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":true,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:downline_goldmine:builder:*:*:*:*:*:*:*:*","matchCriteriaId":"7DE9CE32-AAA6-4EC0-AB77-896FD84FBB3D"},{"vulnerable":true,"criteria":"cpe:2.3:a:downline_goldmine:builder:special_category_addon:*:*:*:*:*:*:*","matchCriteriaId":"FCD0CC04-097F-4455-995E-BC82723F46ED"},{"vulnerable":true,"criteria":"cpe:2.3:a:downline_goldmine:builder:unknown:unknown:pro:*:*:*:*:*","matchCriteriaId":"49C85BB9-3E89-4D3D-BC7D-04DB53E40216"},{"vulnerable":true,"criteria":"cpe:2.3:a:downline_goldmine:new_addon:*:*:*:*:*:*:*:*","matchCriteriaId":"BB86E912-0A05-4337-B573-B2E5EA3ACCE5"},{"vulnerable":true,"criteria":"cpe:2.3:a:downline_goldmine:new_addon:pro:*:*:*:*:*:*:*","matchCriteriaId":"5BE9D3ED-5EB3-4190-9A7C-46299368E3A6"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2008","CveId":"4178","Ordinal":"1","Title":"CVE-2008-4178","CVE":"CVE-2008-4178","Year":"2008"},"notes":[{"CveYear":"2008","CveId":"4178","Ordinal":"1","NoteData":"SQL injection vulnerability in tr.php in DownlineGoldmine Special Category Addon, Downline Builder Pro, New Addon, and Downline Goldmine Builder allows remote attackers to execute arbitrary SQL commands via the id parameter.  NOTE: some of these details are obtained from third party information.","Type":"Description","Title":"CVE-2008-4178"},{"CveYear":"2008","CveId":"4178","Ordinal":"2","NoteData":"2008-09-23","Type":"Other","Title":"Published"},{"CveYear":"2008","CveId":"4178","Ordinal":"3","NoteData":"2017-09-28","Type":"Other","Title":"Modified"}]}}}