CVE-2008-7091

Estado: ModificadaAlta (7.5)—💥 Exploit

Multiple SQL injection vulnerabilities in Pligg 9.9 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to vote.php, which is not properly handled in libs/link.php; (2) id parameter to trackback.php; (3) an unspecified parameter to submit.php; (4) requestTitle variable in a query to story.php; (5) requestID and (6) requestTitle variables in recommend.php; (7) categoryID parameter to cloud.php; (8) title parameter to out.php; (9) username parameter to login.php; (10) id parameter to cvote.php; and (11) commentid parameter to edit.php.

CVSS

Versión: 2.0
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Puntuación base: 7.5

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 2.10%
Percentil entre todas las CVEs puntuadas: 81
Fecha de la puntuación: 7/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

💥 Exploits públicos

Hay código de explotación o plantillas de detección públicos. No es lo mismo que explotación activa confirmada (KEV), pero aumenta el riesgo: parchee con prioridad.

Publicado en Exploit-DB · Pligg CMS 9.9.0 - Remote Code Execution (30/7/2008)
Publicado en Exploit-DB · Pligg CMS 9.9.0 - Cross-Site Scripting / Local File Inclusion / SQL Injection (30/7/2008)

Tecnologías afectadas (1)

Pligg — Pligg CMS

CWE

CWE-89

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2008-7091",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2009-08-26T14:24:17.077",
  "references": [
    {
      "url": "http://www.gulftech.org/?node=research&article_id=00120-07312008",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.osvdb.org/50189",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.osvdb.org/50190",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.osvdb.org/50191",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.osvdb.org/50192",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.osvdb.org/50193",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.osvdb.org/50194",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.osvdb.org/50195",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.osvdb.org/50196",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.osvdb.org/50197",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.osvdb.org/50198",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/494987/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/30458",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44193",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.exploit-db.com/exploits/6173",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.gulftech.org/?node=research&article_id=00120-07312008",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.osvdb.org/50189",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.osvdb.org/50190",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.osvdb.org/50191",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.osvdb.org/50192",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.osvdb.org/50193",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.osvdb.org/50194",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.osvdb.org/50195",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.osvdb.org/50196",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.osvdb.org/50197",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.osvdb.org/50198",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/494987/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/30458",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44193",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.exploit-db.com/exploits/6173",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple SQL injection vulnerabilities in Pligg 9.9 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to vote.php, which is not properly handled in libs/link.php; (2) id parameter to trackback.php; (3) an unspecified parameter to submit.php; (4) requestTitle variable in a query to story.php; (5) requestID and (6) requestTitle variables in recommend.php; (7) categoryID parameter to cloud.php; (8) title parameter to out.php; (9) username parameter to login.php; (10) id parameter to cvote.php; and (11) commentid parameter to edit.php."
    },
    {
      "lang": "es",
      "value": "Múltiples vulnerabilidades de inyección SQL en Pligg v9.9 y anteriores, permite a atacantes remotos ejecutar comandos SQL de su elección  a través de el (1)parámetro id a vote.php, que no está manejado adecuadamente en libs/link.php; de los parámetros (2) id ao trackback.php; (3) un parámetro no especificado a submit.php; (4) la variable requestTitle en una consulta a  story.php; las variables (5) requestID y (6) requestTitle en recommend.php; los parámetros(7) categoryID a cloud.php; (8) title a out.php; (9) username a login.php; (10) id a cvote.php y(11) commentid a edit.php."
    }
  ],
  "lastModified": "2026-06-16T23:03:34.773",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:pligg:pligg_cms:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "74D4E140-8598-4BC4-BED2-D884BF4F1452",
              "versionEndIncluding": "9.9.0"
            },
            {
              "criteria": "cpe:2.3:a:pligg:pligg_cms:9.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BC61B629-A379-4D0B-B653-F8C17B1F69A5"
            },
            {
              "criteria": "cpe:2.3:a:pligg:pligg_cms:9.9.0:beta:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "66E91F30-8583-40CF-A2D5-4631DECEAA08"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}