CVE-2008-6805

CVE-2008-6805 describes multiple SQL injection vulnerabilities in Mic_Blog version 0.0.3. These flaws, present when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands through the 'cat' parameter in category.php, 'user' parameter in login.php, and 'site' parameter in register.php. The vulnerability carries a CVSS score of 6.8, indicating medium severity with a network attack vector, medium attack complexity, and potential for partial compromise of confidentiality, integrity, and availability. This means an attacker can exploit it remotely without authentication, but some conditions must be met. While not listed on the CISA KEV catalog, an exploit for privilege escalation is publicly available on ExploitDB. Despite this, there is no evidence of active exploitation, and the CVE has received minimal community discussion or media coverage.