Description
SQL injection vulnerability in Slashdot Like Automated Storytelling Homepage (Slash) (aka Slashcode) R_2_5_0_94 and earlier allows remote attackers to execute SQL commands and read table information via the id parameter.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | slash | 2.2.6-8etch1 | DSA-1633-1 |
Advisories 1
- DSA-1633-1 slash - multiple vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://www.slashcode.com/article.pl?sid=08/01/07/2314232
- 31691 third-party-advisory
- 1020206 vdb-entry
- [oss-security] 20080604 Re: CVE id request: slash mailing-list
- [oss-security] 20080604 CVE id request: slash mailing-list
- slash-id-sql-injection(42880) vdb-entry
- 3923 third-party-advisory
- http://slashcode.cvs.sourceforge.net/slashcode/slash/Slash/Utility/Environment/Environment.pm?r1=1.223&r2=1.225
- http://www.slashcode.com/article.pl?sid=08/01/04/1950244&tid=4
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=484499
- DSA-1633 vendor-advisory
- 30551 third-party-advisory
- 29548 vdb-entry