CVE-2008-1990 json
Multiple SQL injection vulnerabilities in Acidcat CMS 3.4.1 allow remote attackers to execute arbitrary SQL commands via the (1) cID parame…
published 2008-04-27 18 y ago modified 2026-06-16 4 mo ago also EUVD-2008-1988
- cvss
- 7.5
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.2%
- EPSS 1.2% chance of exploitation in 30 days, percentile 68%
- public exploits
- 1
- Exploit-DB
Summary
Multiple SQL injection vulnerabilities in Acidcat CMS 3.4.1 allow remote attackers to execute arbitrary SQL commands via the (1) cID parameter to default.asp and the (2) username parameter to main_login2.asp.
Timeline
- First public exploit (EDB-5478)
- Published
Exploit prediction
1.19% chance of exploitation in the next 30 days, higher than 68% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-5478 Acidcat CMS 3.4.1 - Multiple Vulnerabilities webapps, 2008-04-20
- bugreport.ir http://bugreport.ir/index.php?/36 referenced PoC, tagged "exploit" by a source, unverified
- securityfocus.com http://www.securityfocus.com/bid/28868 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Classification
- Weakness
-
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command
References
-
exploit-db.com
/exploits/5478
exploit
-
bugreport.ir
/index.php?/36
exploit
-
securityfocus.com
/bid/28868
vdb-entry, exploit
-
secunia.com
/advisories/29916
third-party-advisory, vendor-advisory
-
securityreason.com
/securityalert/3842
third-party-advisory
-
securityfocus.com
/archive/1/491129/100/0/threaded
mailing-list
-
exchange.xforce.ibmcloud.com
/vulnerabilities/41918
vdb-entry
Sources
- CVE List CVE-2008-1990
- NVD CVE-2008-1990
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.