LedgerSMB up to 1.2.14 sql injection

Summaryinfo

A vulnerability classified as critical has been found in LedgerSMB. The impacted element is an unknown function. This manipulation causes sql injection. The identification of this vulnerability is CVE-2008-4078. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability classified as critical was found in LedgerSMB. Affected by this vulnerability is some unknown processing. The manipulation with an unknown input leads to a sql injection vulnerability. The CWE definition for the vulnerability is CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

SQL injection vulnerability in the AR/AP transaction report in (1) LedgerSMB (LSMB) before 1.2.15 and (2) SQL-Ledger 2.8.17 and earlier allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

The weakness was shared 09/15/2008 (Website). The advisory is shared at securityfocus.com. This vulnerability is known as CVE-2008-4078 since 09/15/2008. The exploitation appears to be easy. The attack can be launched remotely. Required for exploitation is a single authentication. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1505 for this issue.

It is declared as highly functional.

The vulnerability is also documented in the databases at X-Force (45034), SecurityFocus (BID 31109†) and Secunia (SA31843†). The entry VDB-44028 is related to this item. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• LedgerSMB

Version

• 1.0.0
• 1.1.0
• 1.1.1
• 1.1.5
• 1.1.8
• 1.2.0
• 1.2.1
• 1.2.2
• 1.2.3
• 1.2.4
• 1.2.5
• 1.2.6
• 1.2.7
• 1.2.8
• 1.2.9
• 1.2.10
• 1.2.11
• 1.2.12
• 1.2.13
• 1.2.14

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion