CVE-2008-3591

Twentyone Degrees Symphony <1.7.01 - SQL Injection

Title source: llm

Description

SQL injection vulnerability in lib/class.admin.php in Twentyone Degrees Symphony 1.7.01 and earlier allows remote attackers to execute arbitrary SQL commands via the sym_auth cookie in a /publish/filemanager/ request to index.php.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Raz0r · phpwebappsphp

https://www.exploit-db.com/exploits/6177

View Code ZIP pw:eip

References (5)

[Patch] http://overture21.com/forum/comments.php?DiscussionID=1823

[Patch, Vendor Advisory] http://secunia.com/advisories/31293

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/30477

[Exploit, Third Party Advisory] https://www.exploit-db.com/exploits/6177

[Third Party Advisory] http://securityreason.com/securityalert/4137

Scores

EPSS 0.0044

EPSS Percentile 63.4%

Details

CWE

CWE-89

Status published

Products (7)

21degrees/symphony 1.1

21degrees/symphony 1.5

21degrees/symphony 1.5.05

21degrees/symphony 1.5.06

21degrees/symphony 1.6.02

21degrees/symphony 1.7

21degrees/symphony < 1.7.01

Published Aug 11, 2008

Tracked Since Feb 18, 2026