CVE-2008-4078
LedgerSMB < 1.2.15 and SQL-Ledger < 2.8.17 - Authenticated SQL Injection
Title source: llmDescription
SQL injection vulnerability in the AR/AP transaction report in (1) LedgerSMB (LSMB) before 1.2.15 and (2) SQL-Ledger 2.8.17 and earlier allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
References (6)
Core 6
Core References
Product x_refsource_confirm
http://sourceforge.net/project/shownotes.php?group_id=175965&release_id=624978
Patch, Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/31843
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/45034
Patch, Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/31109
Broken Link, Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/496181/100/0/threaded
Third Party Advisory third-party-advisory
x_refsource_sreason
http://securityreason.com/securityalert/4250
Scores
EPSS
0.0162
EPSS Percentile
73.7%
Details
CWE
CWE-89
Status
published
Products (2)
ledgersmb/ledgersmb
< 1.2.15
sql-ledger/sql-ledger
< 2.8.17
Published
Sep 15, 2008
Tracked Since
Feb 18, 2026