CVE-2008-7049

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Multiple SQL injection vulnerabilities in login.asp in NatterChat 1.1 and 1.12 allow remote attackers to execute arbitrary SQL commands via the (1) txtUsername parameter (aka Username) and (2) txtPassword parameter (aka Password) in a form generated by home.asp. NOTE: due to lack of details, it is not clear whether this is related to CVE-2004-2206.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Aug 24, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2008

CVE-2008-70507.5The password_check function in auth/auth_phpbb3.php in WoW Raid Manager 3.5.1 before Patch 1, when using PHPBB3 authentication, (1) does not CVE-2008-70517.5AJ Square AJ Article allows remote attackers to bypass authentication and access administrator functionality via a direct request to (1) use CVE-2008-70526.5Unrestricted file upload vulnerability in profile.php in Pre Projects Pre Real Estate Listings allows remote authenticated users to execute CVE-2008-70539.3LogMeIn Remote Access Utility ActiveX control (RACtrl.dll) allows remote attackers to cause a denial of service (crash) by setting the fgcol CVE-2008-70545.1Multiple directory traversal vulnerabilities in ezContents 2.0.3 allow remote attackers to include and execute arbitrary local files via the CVE-2008-70555.1module.php in ezContents 2.0.3 allows remote attackers to bypass the directory traversal protection mechanism to include and execute arbitra CVE-2008-70565.0BandSite CMS 1.1.4 does not perform access control for adminpanel/phpmydump.php, which allows remote attackers to obtain copies of the datab CVE-2008-70574.3Cross-site scripting (XSS) vulnerability in merchandise.php in BandSite CMS 1.1.4 allows remote attackers to inject arbitrary HTML or web sc CVE-2008-70586.8Cross-site request forgery (CSRF) vulnerability in BandSite CMS 1.1.4 allows remote attackers to hijack the authentication of administrators CVE-2008-70597.5SQL injection vulnerability in index.php in One-News Beta 2 allows remote attackers to execute arbitrary SQL commands via the q parameter.CVE-2008-70604.3Multiple cross-site scripting (XSS) vulnerabilities in One-News Beta 2 allow remote attackers to inject arbitrary HTML and web script via th CVE-2008-70614.3The tooltip manager (chrome/views/tooltip_manager.cc) in Google Chrome 0.2.149.29 Build 1798 and possibly other versions before 0.2.149.30 a