CVE-2008-6163: openx SQL Injection

Modified

Published 18-02-2009Last modified 07-08-2024

Vulnerability summary

CVE-2008-6163 is a high (CVSS 7.5) SQL Injection vulnerability in openx. EPSS estimates a 2.35% chance of exploitation in the next 30 days, higher than 83.5% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk

40/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.5/10

010

High · v2.0 (NVD)

EPSS score

2.35%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits2reference, exploit-database

Timeline

18-02-2009
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

SQL injection vulnerability in www/delivery/ac.php in OpenX 2.6.1 allows remote attackers to execute arbitrary SQL commands via the bannerid parameter.

CVSS metrics

1 score · 1 source · 1 version

v2.07.5

EPSS trend

Probability

2.35%

Chance of exploitation in the next 30 days

Percentile

84%

Versus all other CVEs

30-day change

No change 0.00 pp

From 2.35% on 22-09-2026

22-09-202622-10-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

2 found

referenceUnverified
Exploit Reference (securityfocus.com)
Maturity: unknown
exploit-databasephpVerified
OpenX 2.6 - 'bannerid' Blind SQL Injection
Maturity: poc

Weaknesses

CWE · root cause

CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Affected systems

Openx1 product

openx2.6.1

1 vendor · 1 product

References

5 links

www.exploit-db.com/exploits/6655ExploitX Refsource EXPLOIT DB
exchange.xforce.ibmcloud.com/vulnerabilities/45631VDB EntryX Refsource XF
secunia.com/advisories/32114Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.securityfocus.com/bid/31549VDB EntryX Refsource BIDExploitPatch
forum.openx.org/index.php?s=8d4c74dab4fd4597a7facda7c7414703&showtopic=503422735X Refsource MISCVendor Advisory