CVE-2008-4161: Assetman

Medium severity, CVSS 6.8. EPSS: 2% chance of exploitation in the next 30 days.

SQL injection vulnerability in search_inv.php in Assetman 2.5b allows remote attackers to execute arbitrary SQL commands and conduct session fixation attacks via a combination of crafted order and order_by parameters in a search_all action.

Affected products

• Assetman Assetman: version 2.5b only

Published 2008-09-22. Last modified 2026-06-16.