CVE-2008-5998

CVE-2008-5998 describes multiple SQL injection vulnerabilities within the ajax_checklist_save function of the Ajax Checklist module for Drupal, specifically versions 5.x before 5.x-1.1. This flaw allows remote, authenticated users with "update ajax checklists" permissions to execute arbitrary SQL commands through manipulated nid, qid, or state parameters during a save operation. The vulnerability carries a CVSS score of 6.0, indicating a medium severity. It requires authentication (Au:S) and moderate attack complexity (AC:M), but can be exploited remotely (AV:N), potentially leading to partial compromise of confidentiality, integrity, and availability (C:P/I:P/A:P). While not listed on the KEV catalog or Hot List, exploit code for this vulnerability is publicly available on ExploitDB. There is no evidence of active exploitation, and it has garnered minimal community discussion or media coverage.