« Back to list

CVE-2008-4148

Status: ModifiedHigh (7.5)—

SQL injection vulnerability in the Mailhandler module 5.x before 5.x-1.4 and 6.x before 6.x-1.4, a module for Drupal, allows remote attackers to execute arbitrary SQL commands via unspecified vectors, related to composing queries without using the Drupal database API.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Drupal — Mailhandler

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2008-4148",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": true,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2008-09-24T05:41:38.937",
  "references": [
    {
      "url": "http://drupal.org/node/309769",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/31877",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/31230",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2008/2616",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45216",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://drupal.org/node/309769",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/31877",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/31230",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2008/2616",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45216",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "SQL injection vulnerability in the Mailhandler module 5.x before 5.x-1.4 and 6.x before 6.x-1.4, a module for Drupal, allows remote attackers to execute arbitrary SQL commands via unspecified vectors, related to composing queries without using the Drupal database API."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de inyección SQL en el módulo Mailhandler 5.x y versiones anteriores 5.x-1.4 y 6.x y versiones anteriores 6.x-1.4, a módulo para Drupal, que permite a los atacantes remotos ejecutar arbitrariamente comandos SQL a través de un vector no especificado, en relación a componer consultas sin usar la base de datos de la API de Drupal."
    }
  ],
  "lastModified": "2026-06-16T22:57:16.047",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:drupal:mailhandler:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0F81D7AC-3CB3-4505-9A47-A6B5FD341BF1",
              "versionEndIncluding": "5.x-1.3"
            },
            {
              "criteria": "cpe:2.3:a:drupal:mailhandler:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3916F026-791B-4571-90CB-138174DE0ED1",
              "versionEndIncluding": "6.x-1.3"
            },
            {
              "criteria": "cpe:2.3:a:drupal:mailhandler:5.x-1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0A450AB9-CED8-47F5-BA79-43BD6C4D5C12"
            },
            {
              "criteria": "cpe:2.3:a:drupal:mailhandler:5.x-1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D7959A1F-0F00-4DD0-B941-7192156DEDFC"
            },
            {
              "criteria": "cpe:2.3:a:drupal:mailhandler:5.x-1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "02627781-79D7-46AB-876A-A20E73AA4D39"
            },
            {
              "criteria": "cpe:2.3:a:drupal:mailhandler:5.x-1.x-dev:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5333C4C9-3695-443B-BC93-8013F943BB46"
            },
            {
              "criteria": "cpe:2.3:a:drupal:mailhandler:6.x-1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2D0B3136-93C8-425F-929F-3DE64146F195"
            },
            {
              "criteria": "cpe:2.3:a:drupal:mailhandler:6.x-1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B5A57EDC-1AB2-4162-B642-46B39E992D8F"
            },
            {
              "criteria": "cpe:2.3:a:drupal:mailhandler:6.x-1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2D031605-388D-4012-8D35-33180B1E1A25"
            },
            {
              "criteria": "cpe:2.3:a:drupal:mailhandler:6.x-1.x-dev:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8825553C-E06A-4768-8491-A14E5B9083A0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}