FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2008-6509

This CVE name corresponds to:

Entered	Topic
2008-11-19	openfire -- multiple vulnerabilities

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2008-6509 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2008-6509
Phase	Assigned(20090323)

Description

SQL injection vulnerability in CallLogDAO in SIP Plugin in Openfire 3.6.0a and earlier allows remote attackers to execute arbitrary SQL commands via the type parameter to sipark-log-summary.jsp.

References

Source	Reference
BUGTRAQ	20081108 [AK-ADV2008-001] Openfire Jabber-Server: Multiple Vulnerabilities (Authentication Bypass, SQL injection, ...)
MILW0RM	7075
MISC	http://www.andreas-kurtz.de/advisories/AKADV2008-001-v1.0.txt
MISC	http://www.andreas-kurtz.de/archives/63
CONFIRM	http://www.igniterealtime.org/issues/browse/JM-1488
BID	32189
OSVDB	51912
SECUNIA	32478
VUPEN	ADV-2008-3061
XF	openfire-siparklogsummary-sql-injection(46487)