CVE-2008-6260

Ultrastats 0.2.144 and 0.3.11 - SQL Injection via serverid Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2008-6260. PoCs published by eek.

AI-analyzed exploit summary This is a writeup detailing a SQL injection vulnerability in Ultrastats versions 0.3.11 and 0.2.144. It provides the injection query and example URLs to exploit the vulnerability.

Description

SQL injection vulnerability in index.php in Ultrastats 0.2.144 and 0.3.11 allows remote attackers to execute arbitrary SQL commands via the serverid parameter.

Exploits (1)

exploitdb WRITEUP VERIFIED
by eek · textwebappsphp
https://www.exploit-db.com/exploits/7148

This is a writeup detailing a SQL injection vulnerability in Ultrastats versions 0.3.11 and 0.2.144. It provides the injection query and example URLs to exploit the vulnerability.

Classification
Writeup 90%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target: Ultrastats versions 0.3.11 and 0.2.144
No auth needed
Prerequisites: Access to the target URL with the vulnerable parameter
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/46661
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/32724
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/32340
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/7148

Scores

EPSS 0.0049
EPSS Percentile 65.5%

Details

CWE
CWE-89
Status published
Products (2)
ultrastats/ultrastats 0.2.144
ultrastats/ultrastats 0.3.11
Published Feb 24, 2009
Tracked Since Feb 18, 2026