Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Simple Document Management System login lets attackers run database commands

CVE-2008-6236 · published 17 years ago
Summary

The login page in Simple Document Management System versions 1.1.4, 1.1.5 (and possibly earlier) can be tricked into running unintended database queries. An attacker could manipulate the login field to view, change, or delete stored data. Apply any available security patches, restrict access to the login page, and consider upgrading to a newer, fixed version.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
cafuego simple_document_management_system 1.1.4
1.1.5
cpe:2.3:a:cafuego:simple_document_management_system:1.1.4:*:*:*:*:*:*:*
Original advisory text
SQL injection vulnerability in login.php in Simple Document Management System (SDMS) 1.1.5 and 1.1.4, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the login p...
SQL injection vulnerability in login.php in Simple Document Management System (SDMS) 1.1.5 and 1.1.4, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the login parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published21 Feb 2009
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2008-6236 · NVD
Track software like this
Free during beta