CVE-2008-5998

MediumCVSS 6.0/10Last modified Jun 16, 2026

Description

Multiple SQL injection vulnerabilities in the ajax_checklist_save function in the Ajax Checklist module 5.x before 5.x-1.1 for Drupal allow remote authenticated users, with "update ajax checklists" permissions, to execute arbitrary SQL commands via a save operation, related to the (1) nid, (2) qid, and (3) state parameters.

Metrics

CVSS 2.0 6.0/10AV:N/AC:M/Au:S/C:P/I:P/A:P

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://drupal.org/node/312968Patch, Vendor Advisory
http://secunia.com/advisories/32009Vendor Advisory
http://www.securityfocus.com/archive/1/496727/100/0/threaded
http://www.securityfocus.com/bid/31384Exploit, Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/45410
http://drupal.org/node/312968Patch, Vendor Advisory
http://secunia.com/advisories/32009Vendor Advisory
http://www.securityfocus.com/archive/1/496727/100/0/threaded
http://www.securityfocus.com/bid/31384Exploit, Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/45410

Timeline

Published: Jan 28, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2008

CVE-2008-59993.5Cross-site scripting (XSS) vulnerability in the Ajax Checklist module 5.x before 5.x-1.1 for Drupal allows remote authenticated users, with CVE-2008-60007.2The GDTdiIcpt.sys driver in G DATA AntiVirus 2008, InternetSecurity 2008, and TotalCare 2008 populates kernel registers with IOCTL 0x8317001 CVE-2008-60017.5index.php in ADN Forum 1.0b and earlier allows remote attackers to bypass authentication and gain sysop access via a fpusuario cookie compos CVE-2008-60027.1Absolute path traversal vulnerability in sendfile.php in web-cp 0.5.7, when register_globals is enabled, allows remote attackers to read arb CVE-2008-60037.5SQL injection vulnerability in sellers_othersitem.php in AJ Auction Pro Platinum 2 allows remote attackers to execute arbitrary SQL commands CVE-2008-60044.3Cross-site scripting (XSS) vulnerability in search.php in AJ Auction Pro Platinum 2 allows remote attackers to inject arbitrary web script o CVE-2008-600510.0Multiple buffer overflows in the CheckUniqueName function in W3C Amaya Web Browser 10.0.1, and possibly other versions including 11.0.1, mig CVE-2008-60067.5Multiple PHP remote file inclusion vulnerabilities in Micronation Banking System (minba) 1.5.0 allow remote attackers to execute arbitrary P CVE-2008-60077.5SQL injection vulnerability in view_group.php in QuidaScript BookMarks Favourites Script (APB) allows remote attackers to execute arbitrary CVE-2008-60085.0hyBook Guestbook Script stores sensitive information under the web root with insufficient access control, which allows remote attackers to d CVE-2008-60097.5SG Real Estate Portal 2.0 allows remote attackers to bypass authentication and gain administrative access by setting the Auth cookie to 1.CVE-2008-60105.0Multiple directory traversal vulnerabilities in SG Real Estate Portal 2.0 allow remote attackers to read arbitrary files via a .. (dot dot)