CVE-2008-4768

TLM CMS 3.1 - SQL Injection via nom Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2008-4768. PoCs published by ZoRLu.

AI-analyzed exploit summary The exploit demonstrates SQL injection vulnerabilities in TLM CMS 3.1 by injecting malicious SQL queries via the 'nom' and 'idnews' parameters. It extracts sensitive user data such as passwords, emails, and usernames from the 'pphp_user' table.

Description

SQL injection vulnerability in TLM CMS 3.1 allows remote attackers to execute arbitrary SQL commands via the nom parameter to a-b-membres.php. NOTE: the goodies.php vector is already covered by CVE-2007-4808. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

Exploits (1)

exploitdb WORKING POC VERIFIED
by ZoRLu · textwebappsphp
https://www.exploit-db.com/exploits/31668

The exploit demonstrates SQL injection vulnerabilities in TLM CMS 3.1 by injecting malicious SQL queries via the 'nom' and 'idnews' parameters. It extracts sensitive user data such as passwords, emails, and usernames from the 'pphp_user' table.

Classification
Working Poc 90%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target: TLM CMS 3.1
No auth needed
Prerequisites: Access to the vulnerable TLM CMS application
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/28837
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/41923

Scores

EPSS 0.0027
EPSS Percentile 50.1%

Details

CWE
CWE-89
Status published
Products (1)
tlm_cms/tlm_cms 3.1
Published Oct 28, 2008
Tracked Since Feb 18, 2026