CVE-2008-5892

CVE-2008-5892 describes multiple SQL injection vulnerabilities in icash Click&Email, allowing remote attackers to execute arbitrary SQL commands. Specifically, these flaws exist in the ID parameter of admin_dblayers.asp during an update action, and in the adminid and PassWord parameters of admin_loginCheck.asp (corresponding to the USERNAME and PASSWORD fields in admin_main.asp). The vulnerability has a CVSS score of 7.5 (High), indicating a significant risk. It is easily exploitable over the network with low attack complexity and no authentication required, potentially leading to full compromise of confidentiality, integrity, and availability. While there is no evidence of active exploitation or inclusion in the CISA KEV catalog, exploit code is publicly available via ExploitDB (EDB-7485). Despite this, there is minimal community discussion or media coverage surrounding this CVE.