Vulnerability Description
SQL injection vulnerability in the AR/AP transaction report in (1) LedgerSMB (LSMB) before 1.2.15 and (2) SQL-Ledger 2.8.17 and earlier allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ledgersmb | Ledgersmb | < 1.2.15 |
| Sql-Ledger | Sql-Ledger | <= 2.8.17 |
Related Weaknesses (CWE)
References
- http://secunia.com/advisories/31843PatchVendor Advisory
- http://securityreason.com/securityalert/4250Third Party Advisory
- http://sourceforge.net/project/shownotes.php?group_id=175965&release_id=624978Product
- http://www.securityfocus.com/archive/1/496181/100/0/threadedBroken LinkThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/bid/31109PatchThird Party AdvisoryVDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45034Third Party AdvisoryVDB Entry
- http://secunia.com/advisories/31843PatchVendor Advisory
- http://securityreason.com/securityalert/4250Third Party Advisory
- http://sourceforge.net/project/shownotes.php?group_id=175965&release_id=624978Product
- http://www.securityfocus.com/archive/1/496181/100/0/threadedBroken LinkThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/bid/31109PatchThird Party AdvisoryVDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45034Third Party AdvisoryVDB Entry
FAQ
What is CVE-2008-4078?
CVE-2008-4078 is a vulnerability with a CVSS score of 6.5 (MEDIUM). SQL injection vulnerability in the AR/AP transaction report in (1) LedgerSMB (LSMB) before 1.2.15 and (2) SQL-Ledger 2.8.17 and earlier allows remote authenticated users to execute arbitrary SQL comma...
How severe is CVE-2008-4078?
CVE-2008-4078 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2008-4078?
Check the references section above for vendor advisories and patch information. Affected products include: Ledgersmb Ledgersmb, Sql-Ledger Sql-Ledger.