{"api_version":"1","generated_at":"2026-07-23T09:36:14+00:00","cve":"CVE-2008-6525","urls":{"html":"https://cve.report/CVE-2008-6525","api":"https://cve.report/api/cve/CVE-2008-6525.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2008-6525","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2008-6525"},"summary":{"title":"CVE-2008-6525","description":"SQL injection vulnerability in the Admin Panel in Nice PHP FAQ Script (Knowledge base Script) allows remote attackers to execute arbitrary SQL commands via the Password parameter (aka the pass field).","state":"PUBLISHED","assigner":"mitre","published_at":"2009-03-25 18:30:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-89","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/46402","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/46402","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.exploit-db.com/exploits/7018","name":"https://www.exploit-db.com/exploits/7018","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"NICE FAQ Script (Auth Bypass) SQL Injection Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/32150","name":"http://www.securityfocus.com/bid/32150","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"Nice PHP FAQ Script 'Admin Panel' SQL Injection Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2008-6525","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-6525","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2008","cve_id":"6525","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"nicephpscripts","cpe5":"nice_php_faq_script","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T11:34:47.003Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"7018","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"],"url":"https://www.exploit-db.com/exploits/7018"},{"name":"32150","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/32150"},{"name":"nicephpfaq-unspecified-sql-injection(46402)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/46402"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2008-11-06T00:00:00.000Z","descriptions":[{"lang":"en","value":"SQL injection vulnerability in the Admin Panel in Nice PHP FAQ Script (Knowledge base Script) allows remote attackers to execute arbitrary SQL commands via the Password parameter (aka the pass field)."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-09-28T12:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"7018","tags":["exploit","x_refsource_EXPLOIT-DB"],"url":"https://www.exploit-db.com/exploits/7018"},{"name":"32150","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/32150"},{"name":"nicephpfaq-unspecified-sql-injection(46402)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/46402"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2008-6525","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"SQL injection vulnerability in the Admin Panel in Nice PHP FAQ Script (Knowledge base Script) allows remote attackers to execute arbitrary SQL commands via the Password parameter (aka the pass field)."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"7018","refsource":"EXPLOIT-DB","url":"https://www.exploit-db.com/exploits/7018"},{"name":"32150","refsource":"BID","url":"http://www.securityfocus.com/bid/32150"},{"name":"nicephpfaq-unspecified-sql-injection(46402)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/46402"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2008-6525","datePublished":"2009-03-25T18:00:00.000Z","dateReserved":"2009-03-25T00:00:00.000Z","dateUpdated":"2024-08-07T11:34:47.003Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2009-03-25 18:30:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-89","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:nicephpscripts:nice_php_faq_script:*:*:*:*:*:*:*:*","matchCriteriaId":"C3F88EB8-7988-4D78-9F9B-22360EBAB0F4"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2008","CveId":"6525","Ordinal":"1","Title":"CVE-2008-6525","CVE":"CVE-2008-6525","Year":"2008"},"notes":[{"CveYear":"2008","CveId":"6525","Ordinal":"1","NoteData":"SQL injection vulnerability in the Admin Panel in Nice PHP FAQ Script (Knowledge base Script) allows remote attackers to execute arbitrary SQL commands via the Password parameter (aka the pass field).","Type":"Description","Title":"CVE-2008-6525"},{"CveYear":"2008","CveId":"6525","Ordinal":"2","NoteData":"2009-03-25","Type":"Other","Title":"Published"},{"CveYear":"2008","CveId":"6525","Ordinal":"3","NoteData":"2017-09-28","Type":"Other","Title":"Modified"}]}}}