CVE-2008-6120

SocialEngine < 2.7 - SQL Injection via Profile Comments Parameter

Title source: llm
STIX 2.1

Description

SQL injection vulnerability in profile_comments.php in SocialEngine (SE) 2.7 and earlier allows remote attackers to execute arbitrary SQL commands via the comment_secure parameter.

References (3)

Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/46770
Mailing List mailing-list x_refsource_bugtraq
http://marc.info/?l=bugtraq&m=122720734728665&w=2
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/32382

Scores

EPSS 0.0105
EPSS Percentile 60.8%

Details

CWE
CWE-89
Status published
Products (10)
socialengine/socialengine 1.0
socialengine/socialengine 1.1
socialengine/socialengine 1.4
socialengine/socialengine 1.6
socialengine/socialengine 1.7
socialengine/socialengine 1.8
socialengine/socialengine 2.0 (2 CPE variants)
socialengine/socialengine 2.1
socialengine/socialengine 2.4 se
socialengine/socialengine < 2.7
Published Feb 11, 2009
Tracked Since Feb 18, 2026