{"api_version":"1","generated_at":"2026-07-23T06:37:29+00:00","cve":"CVE-2008-4364","urls":{"html":"https://cve.report/CVE-2008-4364","api":"https://cve.report/api/cve/CVE-2008-4364.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2008-4364","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2008-4364"},"summary":{"title":"CVE-2008-4364","description":"SQL injection vulnerability in default.aspx in ParsaGostar ParsaWeb CMS allows remote attackers to execute arbitrary SQL commands via the (1) id parameter in the \"page\" page and (2) txtSearch parameter in the \"Search\" page.","state":"PUBLISHED","assigner":"mitre","published_at":"2008-09-30 23:24:53","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-89","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://www.securityfocus.com/bid/31450","name":"http://www.securityfocus.com/bid/31450","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"ParsaGostar ParsaWeb Multiple SQL Injection Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.exploit-db.com/exploits/6610","name":"https://www.exploit-db.com/exploits/6610","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"ParsaWeb CMS - 'Search' SQL Injection - ASP webapps Exploit","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/archive/1/496799/100/0/threaded","name":"http://www.securityfocus.com/archive/1/496799/100/0/threaded","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.bugreport.ir/index_53.htm","name":"http://www.bugreport.ir/index_53.htm","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"BugReport.ir - ParsaWeb CMS SQL Injection","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/45494","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/45494","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://securityreason.com/securityalert/4343","name":"http://securityreason.com/securityalert/4343","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityReason - ParsaWeb CMS SQL Injection","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2008-4364","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-4364","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2008","cve_id":"4364","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"parsagostar","cpe5":"parsaweb_cms","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T10:17:09.832Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"31450","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/31450"},{"name":"4343","tags":["third-party-advisory","x_refsource_SREASON","x_transferred"],"url":"http://securityreason.com/securityalert/4343"},{"name":"20080928 ParsaWeb CMS SQL Injection","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/496799/100/0/threaded"},{"name":"parsaweb-id-txtsearch-sql-injection(45494)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/45494"},{"name":"6610","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"],"url":"https://www.exploit-db.com/exploits/6610"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.bugreport.ir/index_53.htm"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2008-09-28T00:00:00.000Z","descriptions":[{"lang":"en","value":"SQL injection vulnerability in default.aspx in ParsaGostar ParsaWeb CMS allows remote attackers to execute arbitrary SQL commands via the (1) id parameter in the \"page\" page and (2) txtSearch parameter in the \"Search\" page."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2018-10-11T19:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"31450","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/31450"},{"name":"4343","tags":["third-party-advisory","x_refsource_SREASON"],"url":"http://securityreason.com/securityalert/4343"},{"name":"20080928 ParsaWeb CMS SQL Injection","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/496799/100/0/threaded"},{"name":"parsaweb-id-txtsearch-sql-injection(45494)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/45494"},{"name":"6610","tags":["exploit","x_refsource_EXPLOIT-DB"],"url":"https://www.exploit-db.com/exploits/6610"},{"tags":["x_refsource_MISC"],"url":"http://www.bugreport.ir/index_53.htm"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2008-4364","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"SQL injection vulnerability in default.aspx in ParsaGostar ParsaWeb CMS allows remote attackers to execute arbitrary SQL commands via the (1) id parameter in the \"page\" page and (2) txtSearch parameter in the \"Search\" page."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"31450","refsource":"BID","url":"http://www.securityfocus.com/bid/31450"},{"name":"4343","refsource":"SREASON","url":"http://securityreason.com/securityalert/4343"},{"name":"20080928 ParsaWeb CMS SQL Injection","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/496799/100/0/threaded"},{"name":"parsaweb-id-txtsearch-sql-injection(45494)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/45494"},{"name":"6610","refsource":"EXPLOIT-DB","url":"https://www.exploit-db.com/exploits/6610"},{"name":"http://www.bugreport.ir/index_53.htm","refsource":"MISC","url":"http://www.bugreport.ir/index_53.htm"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2008-4364","datePublished":"2008-09-30T21:00:00.000Z","dateReserved":"2008-09-30T00:00:00.000Z","dateUpdated":"2024-08-07T10:17:09.832Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2008-09-30 23:24:53","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-89","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":true,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:parsagostar:parsaweb_cms:*:*:*:*:*:*:*:*","matchCriteriaId":"5A3FE7B5-7E1B-4411-BF4F-AB8AACEC4F89"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2008","CveId":"4364","Ordinal":"1","Title":"CVE-2008-4364","CVE":"CVE-2008-4364","Year":"2008"},"notes":[{"CveYear":"2008","CveId":"4364","Ordinal":"1","NoteData":"SQL injection vulnerability in default.aspx in ParsaGostar ParsaWeb CMS allows remote attackers to execute arbitrary SQL commands via the (1) id parameter in the \"page\" page and (2) txtSearch parameter in the \"Search\" page.","Type":"Description","Title":"CVE-2008-4364"},{"CveYear":"2008","CveId":"4364","Ordinal":"2","NoteData":"2008-09-30","Type":"Other","Title":"Published"},{"CveYear":"2008","CveId":"4364","Ordinal":"3","NoteData":"2018-10-11","Type":"Other","Title":"Modified"}]}}}