Sign-up

ID

VAR-200901-0071


CVE

CVE-2008-5882


TITLE

Citrix Application Gateway Broadcast Server (BCS) of login.asp In SQL Injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2009-001620

DESCRIPTION

SQL injection vulnerability in login.asp in Citrix Application Gateway - Broadcast Server (BCS) before 6.1, as used by Avaya AG250 - Broadcast Server before 2.0 and possibly other products, allows remote attackers to execute arbitrary SQL commands via the txtUID parameter. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. Other versions may also be affected. PROVIDED AND/OR DISCOVERED BY: The vendor credits the Vulnerability Research Team of Digital Defense, Inc. ORIGINAL ADVISORY: Citrix: http://support.citrix.com/article/CTX119315 ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 2.07

sources: NVD: CVE-2008-5882 // JVNDB: JVNDB-2009-001620 // BID: 32832 // VULHUB: VHN-36007 // PACKETSTORM: 73039

AFFECTED PRODUCTS

vendor:avayamodel:broadcast serverscope:lteversion:2.0

Trust: 1.8

vendor:citrixmodel:broadcast serverscope:lteversion:6.0

Trust: 1.8

vendor:avayamodel:ag250scope:eqversion:2.0

Trust: 0.8

vendor:citrixmodel:application gatewayscope:eqversion:6.0

Trust: 0.8

vendor:avayamodel:broadcast serverscope:eqversion:2.0

Trust: 0.6

vendor:citrixmodel:broadcast serverscope:eqversion:6.0

Trust: 0.3

vendor:avayamodel:ag250scope:eqversion:0

Trust: 0.3

vendor:citrixmodel:broadcast serverscope:neversion:6.1

Trust: 0.3

sources: BID: 32832 // JVNDB: JVNDB-2009-001620 // CNNVD: CNNVD-200901-090 // NVD: CVE-2008-5882

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2008-5882
value: HIGH

Trust: 1.0

NVD: CVE-2008-5882
value: HIGH

Trust: 0.8

CNNVD: CNNVD-200901-090
value: HIGH

Trust: 0.6

VULHUB: VHN-36007
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2008-5882
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-36007
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-36007 // JVNDB: JVNDB-2009-001620 // CNNVD: CNNVD-200901-090 // NVD: CVE-2008-5882

PROBLEMTYPE DATA

problemtype:CWE-89

Trust: 1.9

sources: VULHUB: VHN-36007 // JVNDB: JVNDB-2009-001620 // NVD: CVE-2008-5882

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200901-090

TYPE

sql injection

Trust: 0.7

sources: PACKETSTORM: 73039 // CNNVD: CNNVD-200901-090

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2009-001620

PATCH
title:Top Pageurl:http://www.avaya.com/gcm/master-usa/en-us/home/index.htm
Trust: 0.8
title:CTX119315url:http://support.citrix.com/article/CTX119315
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2009-001620

EXTERNAL IDS
db:NVDid:CVE-2008-5882
Trust: 2.8
db:BIDid:32832
Trust: 2.0
db:SECUNIAid:33127
Trust: 1.8
db:SREASONid:4889
Trust: 1.7
db:SECTRACKid:1021411
Trust: 1.7
db:JVNDBid:JVNDB-2009-001620
Trust: 0.8
db:CNNVDid:CNNVD-200901-090
Trust: 0.7
db:BUGTRAQid:20081223 DDIVRT-2008-16 CITRIX BROADCAST SERVER 6.0 LOGIN.ASP SQL INJECTION --- UPDATE FOR BID 32832
Trust: 0.6
db:VULHUBid:VHN-36007
Trust: 0.1
db:PACKETSTORMid:73039
Trust: 0.1
sources:
            
            
            VULHUB: VHN-36007 // 
            
            
            
            BID: 32832 // 
            
            
            
            JVNDB: JVNDB-2009-001620 // 
            
            
            
            PACKETSTORM: 73039 // 
            
            
            
            CNNVD: CNNVD-200901-090 // 
            
            
            
            NVD: CVE-2008-5882

REFERENCES
url:http://support.citrix.com/article/ctx119315
Trust: 2.1
url:http://www.securityfocus.com/bid/32832
Trust: 1.7
url:http://www.securitytracker.com/id?1021411
Trust: 1.7
url:http://secunia.com/advisories/33127
Trust: 1.7
url:http://securityreason.com/securityalert/4889
Trust: 1.7
url:http://www.securityfocus.com/archive/1/499559/100/0/threaded
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2008-5882
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2008-5882
Trust: 0.8
url:http://www.securityfocus.com/archive/1/archive/1/499559/100/0/threaded
Trust: 0.6
url:http://www.avaya.com
Trust: 0.3
url:http://www.citrix.com
Trust: 0.3
url:/archive/1/499559
Trust: 0.3
url:http://secunia.com/advisories/33127/
Trust: 0.1
url:http://secunia.com/advisories/secunia_security_advisories/
Trust: 0.1
url:http://secunia.com/advisories/business_solutions/
Trust: 0.1
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.1
url:http://secunia.com/advisories/product/20766/
Trust: 0.1
url:http://secunia.com/advisories/about_secunia_advisories/
Trust: 0.1
sources:
            
            
            VULHUB: VHN-36007 // 
            
            
            
            BID: 32832 // 
            
            
            
            JVNDB: JVNDB-2009-001620 // 
            
            
            
            PACKETSTORM: 73039 // 
            
            
            
            CNNVD: CNNVD-200901-090 // 
            
            
            
            NVD: CVE-2008-5882

CREDITS
Corey Lebleu
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-200901-090

SOURCES
db:VULHUBid:VHN-36007
db:BIDid:32832
db:JVNDBid:JVNDB-2009-001620
db:PACKETSTORMid:73039
db:CNNVDid:CNNVD-200901-090
db:NVDid:CVE-2008-5882

LAST UPDATE DATE
2025-04-10T23:24:55.425000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-36007date:2018-10-30T00:00:00
db:BIDid:32832date:2015-04-13T21:12:00
db:JVNDBid:JVNDB-2009-001620date:2009-07-08T00:00:00
db:CNNVDid:CNNVD-200901-090date:2009-01-29T00:00:00
db:NVDid:CVE-2008-5882date:2025-04-09T00:30:58.490

SOURCES RELEASE DATE
db:VULHUBid:VHN-36007date:2009-01-09T00:00:00
db:BIDid:32832date:2008-12-15T00:00:00
db:JVNDBid:JVNDB-2009-001620date:2009-07-08T00:00:00
db:PACKETSTORMid:73039date:2008-12-15T16:47:17
db:CNNVDid:CNNVD-200901-090date:2008-12-15T00:00:00
db:NVDid:CVE-2008-5882date:2009-01-09T18:30:03