Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2008-0616: DMSGuestbook 1.7.0 admin panel can run any SQL

CVE-2008-0616 · published 18 years ago

Summary

If your WordPress site uses the DMSGuestbook 1.7.0 plugin, a logged‑in administrator can enter commands that manipulate the site’s database directly. This could change, delete, or expose data stored by the site. Update the plugin to a patched version or remove it, and review administrator accounts for any unexpected activity.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
dmsguestbook_project	dmsguestbook	1.7.0 `cpe:2.3:a:dmsguestbook_project:dmsguestbook:1.7.0:::::wordpress::`

Original advisory text

SQL injection vulnerability in the administration panel in the DMSGuestbook 1.7.0 plugin for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via unspecified v...

References

http://securityreason.com/securityalert/3615 Third Party Advisory
http://www.securityfocus.com/archive/1/487437/100/0/threaded Third Party Advisory VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/40196 VDB Entry
https://www.exploit-db.com/exploits/5035 Third Party Advisory VDB Entry

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.5 Medium

Exploitation

4% chance of attack within 30 days

Type

CWE-89SQL Injection

Timeline

Published6 Feb 2008

Updated25 Oct 2026

First seen29 Sep 2026

Sources

CVE-2008-0616 · NVD

Track software like this

Free during beta