Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Turnkey Arcade Script lets attackers run unwanted database commands

CVE-2008-5629 · published 17 years ago
Summary

The Turnkey Arcade Script web page that handles game plays can be tricked into running unexpected database instructions when a specially crafted ID value is supplied. This could let a remote user change, delete, or view data stored by the application. Update to the latest version or apply the provided patch to validate the ID parameter.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
turnkeyarcade turnkey_arcade_script _nil_
cpe:2.3:a:turnkeyarcade:turnkey_arcade_script:_nil_:*:*:*:*:*:*:*
Original advisory text
SQL injection vulnerability in index.php in Turnkey Arcade Script allows remote attackers to execute arbitrary SQL commands via the id parameter in a play action.
SQL injection vulnerability in index.php in Turnkey Arcade Script allows remote attackers to execute arbitrary SQL commands via the id parameter in a play action.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published17 Dec 2008
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2008-5629 · NVD
Track software like this
Free during beta