Read the docs
TI-2008-05709 Aliases CVE-2008-6013GHSA-fff6-4q7m-3g6x

Multiple SQL injection vulnerabilities in Freeway before 1.4.3.210 allow remote attackers…

Priority LOW 35CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-89.

Summary

Multiple SQL injection vulnerabilities in Freeway before 1.4.3.210 allow remote attackers to execute arbitrary SQL commands via unspecified vectors involving the (1) advanced search result and (2) service resource pages.

Why it matters now

EPSS 0.01063 64th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 21

CPEVersionsRoleVendor
cpe:2.3:a:openfreeway:freeway:*:*:*:*:*:*:*:*up to 1.4.2.197VulnerableOpenfreeway
cpe:2.3:a:openfreeway:freeway:1.0.25:*:*:*:*:*:*:*1.0.25VulnerableOpenfreeway
cpe:2.3:a:openfreeway:freeway:1.0.25:public_beta:*:*:*:*:*:*1.0.25 public_betaVulnerableOpenfreeway
cpe:2.3:a:openfreeway:freeway:1.0.59:*:*:*:*:*:*:*1.0.59VulnerableOpenfreeway
cpe:2.3:a:openfreeway:freeway:1.0.060:*:*:*:*:*:*:*1.0.060VulnerableOpenfreeway
cpe:2.3:a:openfreeway:freeway:1.1.1.76:*:*:*:*:*:*:*1.1.1.76VulnerableOpenfreeway
cpe:2.3:a:openfreeway:freeway:1.1.1.80:*:*:*:*:*:*:*1.1.1.80VulnerableOpenfreeway
cpe:2.3:a:openfreeway:freeway:1.1.1.81:*:*:*:*:*:*:*1.1.1.81VulnerableOpenfreeway
cpe:2.3:a:openfreeway:freeway:1.2.0.113:*:*:*:*:*:*:*1.2.0.113VulnerableOpenfreeway
cpe:2.3:a:openfreeway:freeway:1.3:*:*:*:*:*:*:*1.3VulnerableOpenfreeway
  • cpe:2.3:a:openfreeway:freeway:*:*:*:*:*:*:*:* Versions up to 1.4.2.197 Vulnerable ·Openfreeway
  • cpe:2.3:a:openfreeway:freeway:1.0.25:*:*:*:*:*:*:* Versions 1.0.25 Vulnerable ·Openfreeway
  • cpe:2.3:a:openfreeway:freeway:1.0.25:public_beta:*:*:*:*:*:* Versions 1.0.25 public_beta Vulnerable ·Openfreeway
  • cpe:2.3:a:openfreeway:freeway:1.0.59:*:*:*:*:*:*:* Versions 1.0.59 Vulnerable ·Openfreeway
  • cpe:2.3:a:openfreeway:freeway:1.0.060:*:*:*:*:*:*:* Versions 1.0.060 Vulnerable ·Openfreeway
  • cpe:2.3:a:openfreeway:freeway:1.1.1.76:*:*:*:*:*:*:* Versions 1.1.1.76 Vulnerable ·Openfreeway
  • cpe:2.3:a:openfreeway:freeway:1.1.1.80:*:*:*:*:*:*:* Versions 1.1.1.80 Vulnerable ·Openfreeway
  • cpe:2.3:a:openfreeway:freeway:1.1.1.81:*:*:*:*:*:*:* Versions 1.1.1.81 Vulnerable ·Openfreeway
  • cpe:2.3:a:openfreeway:freeway:1.2.0.113:*:*:*:*:*:*:* Versions 1.2.0.113 Vulnerable ·Openfreeway
  • cpe:2.3:a:openfreeway:freeway:1.3:*:*:*:*:*:*:* Versions 1.3 Vulnerable ·Openfreeway
Show 11 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:openfreeway:freeway:1.3.0.142:*:*:*:*:*:*:*1.3.0.142VulnerableOpenfreeway
cpe:2.3:a:openfreeway:freeway:1.3.1.142:*:*:*:*:*:*:*1.3.1.142VulnerableOpenfreeway
cpe:2.3:a:openfreeway:freeway:1.3.1.147:*:*:*:*:*:*:*1.3.1.147VulnerableOpenfreeway
cpe:2.3:a:openfreeway:freeway:1.3.2.154:*:*:*:*:*:*:*1.3.2.154VulnerableOpenfreeway
cpe:2.3:a:openfreeway:freeway:1.3.2.160:*:*:*:*:*:*:*1.3.2.160VulnerableOpenfreeway
cpe:2.3:a:openfreeway:freeway:1.3.2.160:joomla_beta:*:*:*:*:*:*1.3.2.160 joomla_betaVulnerableOpenfreeway
cpe:2.3:a:openfreeway:freeway:1.4:*:*:*:*:*:*:*1.4VulnerableOpenfreeway
cpe:2.3:a:openfreeway:freeway:1.4.0.171:*:*:*:*:*:*:*1.4.0.171VulnerableOpenfreeway
cpe:2.3:a:openfreeway:freeway:1.4.1:*:*:*:*:*:*:*1.4.1VulnerableOpenfreeway
cpe:2.3:a:openfreeway:freeway:1.4.1.171:*:*:*:*:*:*:*1.4.1.171VulnerableOpenfreeway
cpe:2.3:a:openfreeway:freeway:1.4.1.197:*:*:*:*:*:*:*1.4.1.197VulnerableOpenfreeway
  • cpe:2.3:a:openfreeway:freeway:1.3.0.142:*:*:*:*:*:*:* Versions 1.3.0.142 Vulnerable ·Openfreeway
  • cpe:2.3:a:openfreeway:freeway:1.3.1.142:*:*:*:*:*:*:* Versions 1.3.1.142 Vulnerable ·Openfreeway
  • cpe:2.3:a:openfreeway:freeway:1.3.1.147:*:*:*:*:*:*:* Versions 1.3.1.147 Vulnerable ·Openfreeway
  • cpe:2.3:a:openfreeway:freeway:1.3.2.154:*:*:*:*:*:*:* Versions 1.3.2.154 Vulnerable ·Openfreeway
  • cpe:2.3:a:openfreeway:freeway:1.3.2.160:*:*:*:*:*:*:* Versions 1.3.2.160 Vulnerable ·Openfreeway
  • cpe:2.3:a:openfreeway:freeway:1.3.2.160:joomla_beta:*:*:*:*:*:* Versions 1.3.2.160 joomla_beta Vulnerable ·Openfreeway
  • cpe:2.3:a:openfreeway:freeway:1.4:*:*:*:*:*:*:* Versions 1.4 Vulnerable ·Openfreeway
  • cpe:2.3:a:openfreeway:freeway:1.4.0.171:*:*:*:*:*:*:* Versions 1.4.0.171 Vulnerable ·Openfreeway
  • cpe:2.3:a:openfreeway:freeway:1.4.1:*:*:*:*:*:*:* Versions 1.4.1 Vulnerable ·Openfreeway
  • cpe:2.3:a:openfreeway:freeway:1.4.1.171:*:*:*:*:*:*:* Versions 1.4.1.171 Vulnerable ·Openfreeway
  • cpe:2.3:a:openfreeway:freeway:1.4.1.197:*:*:*:*:*:*:* Versions 1.4.1.197 Vulnerable ·Openfreeway

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2008-6013
  2. 2026-10-03 Alias added: GHSA-fff6-4q7m-3g6x

References

Other 1

  • TI-2010-02798 SQL injection vulnerability in index.php in Freeway CMS 1.4.3.210 allows remote attackers… CVSS 2.0HIGH 7.5
  • TI-2008-03612 Multiple directory traversal vulnerabilities in Freeway 1.4.1.171, when register_globals… CVSS 2.0MEDIUM 6.8
  • TI-2008-03521 Directory traversal vulnerability in includes/events_application_top.php in Freeway… CVSS 2.0MEDIUM 6.8
  • TI-2008-03611 PHP remote file inclusion vulnerability in admin/create_order_new.php in Freeway… CVSS 2.0MEDIUM 6.8
  • TI-2011-03296 Freeway 1.5 Alpha allows remote attackers to obtain sensitive information via a direct… CVSS 2.0MEDIUM 5.0
  • TI-2008-03680 Cross-site scripting (XSS) vulnerability in admin/search_links.php in Freeway eCommerce… CVSS 2.0MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences