CVE-2008-6509

SQL injection vulnerability in CallLogDAO in SIP Plugin in Openfire 3.6.0a and earlier allows remote attackers to execute arbitrary SQL commands via the type parameter to sipark-log-summary.jsp.

Affected products

Openfire

Igniterealtime Openfire

≤ 3.6.0a, 2.6.0, 2.6.1, 2.6.2, 3.0.0, 3.0.1, 3.1.0, 3.1.1, 3.2.0, 3.2.1, 3.2.2, 3.2.3, 3.2.4, 3.3.0, 3.3.2, 3.3.3, 3.4.0, 3.4.1, 3.4.3, 3.4.4, 3.4.5, 3.5.0, 3.5.1, 3.5.2, 3.6.0

Fix

Available

CVSS 2.0

7.5 HIGH

EPSS

2.0% (79th percentile)

Weakness

CWE-89

NVD status

Modified

Published

2009-03-23