CVE-2008-5926

CVE-2008-5926 describes multiple SQL injection vulnerabilities in the login.asp component of the ASP-DEv Internal E-Mail System. These flaws allow unauthenticated remote attackers to execute arbitrary SQL commands by manipulating the 'login' (user) or 'password' (pass) fields during authentication. With a CVSS score of 7.5, this vulnerability is considered highly severe, enabling full compromise of confidentiality, integrity, and availability (C:P/I:P/A:P) with low attack complexity (AC:L) and no authentication required (Au:N). The FAUCET Risk Score of 88/100 further emphasizes its critical nature. While not listed on the CISA KEV catalog or having Metasploit/Nuclei modules, an authentication bypass exploit (EDB-7447) is publicly available on ExploitDB. Despite this, there is minimal community discussion or media coverage, suggesting it is not widely exploited in the wild.