CVE-2007-1445

SQL injection vulnerability in the heme preview feature for default.asp in BP Blog 7.0 through 7.0.2 allows remote attackers to execute arbitrary SQL commands via the layout parameter.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://blog.betaparticle.com/template_permalink.asp?id=134	Patch
http://osvdb.org/33997
http://secunia.com/advisories/24473	Patch Vendor Advisory
http://www.vupen.com/english/advisories/2007/0919
https://www.exploit-db.com/exploits/3466
http://blog.betaparticle.com/template_permalink.asp?id=134	Patch
http://osvdb.org/33997
http://secunia.com/advisories/24473	Patch Vendor Advisory
http://www.vupen.com/english/advisories/2007/0919
https://www.exploit-db.com/exploits/3466

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:betaparticle:betaparticle_blog::::::::
	cpe:2.3:a:betaparticle:betaparticle_blog:7.0:::::::*

History

21 Nov 2024, 00:28

Type	Values Removed	Values Added
References	~~() http://blog.betaparticle.com/template_permalink.asp?id=134 - Patch~~	() http://blog.betaparticle.com/template_permalink.asp?id=134 - Patch
References	~~() http://osvdb.org/33997 -~~	() http://osvdb.org/33997 -
References	~~() http://secunia.com/advisories/24473 - Patch, Vendor Advisory~~	() http://secunia.com/advisories/24473 - Patch, Vendor Advisory
References	~~() http://www.vupen.com/english/advisories/2007/0919 -~~	() http://www.vupen.com/english/advisories/2007/0919 -
References	~~() https://www.exploit-db.com/exploits/3466 -~~	() https://www.exploit-db.com/exploits/3466 -

Information

Published : 2007-03-14 00:19

Updated : 2024-11-21 00:28

NVD link : CVE-2007-1445

Mitre link : CVE-2007-1445

CVE.ORG link : CVE-2007-1445

JSON object : View

Products Affected

betaparticle

betaparticle_blog

CWE

NVD-CWE-Other

{"id": "CVE-2007-1445", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}]}, "published": "2007-03-14T00:19:00.000", "references": [{"url": "http://blog.betaparticle.com/template_permalink.asp?id=134", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "http://osvdb.org/33997", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/24473", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2007/0919", "source": "cve@mitre.org"}, {"url": "https://www.exploit-db.com/exploits/3466", "source": "cve@mitre.org"}, {"url": "http://blog.betaparticle.com/template_permalink.asp?id=134", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://osvdb.org/33997", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://secunia.com/advisories/24473", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.vupen.com/english/advisories/2007/0919", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.exploit-db.com/exploits/3466", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "SQL injection vulnerability in the heme preview feature for default.asp in BP Blog 7.0 through 7.0.2 allows remote attackers to execute arbitrary SQL commands via the layout parameter."}, {"lang": "es", "value": "Vulnerabilidad de inyecci\u00f3n SQL en la caracter\u00edstica de previsualizaci\u00f3n de heme para default.asp en BP Blog 7.0 hasta 7.0.2 permite a atacantes remotos ejecutar comandos SQL de su elecci\u00f3n mediante el par\u00e1metro layout."}], "lastModified": "2024-11-21T00:28:19.727", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:betaparticle:betaparticle_blog:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "94B1AF4E-5A86-480B-A011-F26028B1EF8E", "versionEndIncluding": "7.0.2"}, {"criteria": "cpe:2.3:a:betaparticle:betaparticle_blog:7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "81AE000D-8F7B-4625-897D-F1C01AE259FE"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}