CVE-2007-1548

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2007-1548
SQL injection vulnerability in functions/functions_filters.asp in Web Wiz Forums before 8.05a (MySQL version) does not properly filter certain characters in SQL commands, which allows remote attackers to execute arbitrary SQL commands via \"' (backslash double-quote quote) sequences, which are collapsed into \'', as demonstrated via the name parameter to forum/pop_up_member_search.asp.

7.5 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://ifsec.blogspot.com/2007/03/web-wiz-forums-805-mysql-version-sql.html Exploit
http://osvdb.org/34344
http://secunia.com/advisories/24561 Vendor Advisory
http://securityreason.com/securityalert/2456 Exploit
http://www.securityfocus.com/archive/1/463287/100/0/threaded
http://www.securityfocus.com/bid/23051 Exploit
http://www.vupen.com/english/advisories/2007/1061 Vendor Advisory
http://www.webwizguide.info/web_wiz_forums/Version%20History.txt
https://exchange.xforce.ibmcloud.com/vulnerabilities/33095
http://ifsec.blogspot.com/2007/03/web-wiz-forums-805-mysql-version-sql.html Exploit
http://osvdb.org/34344
http://secunia.com/advisories/24561 Vendor Advisory
http://securityreason.com/securityalert/2456 Exploit
http://www.securityfocus.com/archive/1/463287/100/0/threaded
http://www.securityfocus.com/bid/23051 Exploit
http://www.vupen.com/english/advisories/2007/1061 Vendor Advisory
http://www.webwizguide.info/web_wiz_forums/Version%20History.txt
https://exchange.xforce.ibmcloud.com/vulnerabilities/33095
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:webwizguide:web_wiz_forums:*:*:*:*:*:*:*:*
cpe:2.3:a:webwizguide:web_wiz_forums:5.21:*:*:*:*:*:*:*
cpe:2.3:a:webwizguide:web_wiz_forums:5.22:*:*:*:*:*:*:*
cpe:2.3:a:webwizguide:web_wiz_forums:6:beta_1:*:*:*:*:*:*
cpe:2.3:a:webwizguide:web_wiz_forums:6:beta_2:*:*:*:*:*:*
cpe:2.3:a:webwizguide:web_wiz_forums:6:beta_3:*:*:*:*:*:*
cpe:2.3:a:webwizguide:web_wiz_forums:6:beta_4:*:*:*:*:*:*
cpe:2.3:a:webwizguide:web_wiz_forums:6:beta_5:*:*:*:*:*:*
cpe:2.3:a:webwizguide:web_wiz_forums:6:beta_6:*:*:*:*:*:*
cpe:2.3:a:webwizguide:web_wiz_forums:6.0:*:*:*:*:*:*:*
cpe:2.3:a:webwizguide:web_wiz_forums:6.10:*:*:*:*:*:*:*
cpe:2.3:a:webwizguide:web_wiz_forums:6.11:*:*:*:*:*:*:*
cpe:2.3:a:webwizguide:web_wiz_forums:6.12:*:*:*:*:*:*:*
cpe:2.3:a:webwizguide:web_wiz_forums:6.20:*:*:*:*:*:*:*
cpe:2.3:a:webwizguide:web_wiz_forums:6.21:*:*:*:*:*:*:*
cpe:2.3:a:webwizguide:web_wiz_forums:6.22:*:*:*:*:*:*:*
cpe:2.3:a:webwizguide:web_wiz_forums:6.23:*:*:*:*:*:*:*
cpe:2.3:a:webwizguide:web_wiz_forums:6.24:*:*:*:*:*:*:*
cpe:2.3:a:webwizguide:web_wiz_forums:6.25:*:*:*:*:*:*:*
cpe:2.3:a:webwizguide:web_wiz_forums:6.26:*:*:*:*:*:*:*
cpe:2.3:a:webwizguide:web_wiz_forums:6.27:*:*:*:*:*:*:*
cpe:2.3:a:webwizguide:web_wiz_forums:6.28:*:*:*:*:*:*:*
cpe:2.3:a:webwizguide:web_wiz_forums:6.29:*:*:*:*:*:*:*
cpe:2.3:a:webwizguide:web_wiz_forums:6.30:*:*:*:*:*:*:*
cpe:2.3:a:webwizguide:web_wiz_forums:6.32:*:*:*:*:*:*:*
cpe:2.3:a:webwizguide:web_wiz_forums:6.33:*:*:*:*:*:*:*
cpe:2.3:a:webwizguide:web_wiz_forums:6.34:*:*:*:*:*:*:*
cpe:2.3:a:webwizguide:web_wiz_forums:7:beta_4:*:*:*:*:*:*
cpe:2.3:a:webwizguide:web_wiz_forums:7:rc1:*:*:*:*:*:*
cpe:2.3:a:webwizguide:web_wiz_forums:7.0:*:*:*:*:*:*:*
cpe:2.3:a:webwizguide:web_wiz_forums:7.01:*:*:*:*:*:*:*
cpe:2.3:a:webwizguide:web_wiz_forums:7.5:*:*:*:*:*:*:*
cpe:2.3:a:webwizguide:web_wiz_forums:7.5:beta_1:*:*:*:*:*:*
cpe:2.3:a:webwizguide:web_wiz_forums:7.6:*:*:*:*:*:*:*
cpe:2.3:a:webwizguide:web_wiz_forums:7.7:*:*:*:*:*:*:*
cpe:2.3:a:webwizguide:web_wiz_forums:7.7a:*:*:*:*:*:*:*
cpe:2.3:a:webwizguide:web_wiz_forums:7.8:*:*:*:*:*:*:*
cpe:2.3:a:webwizguide:web_wiz_forums:7.9:*:*:*:*:*:*:*
cpe:2.3:a:webwizguide:web_wiz_forums:7.51:*:*:*:*:*:*:*
cpe:2.3:a:webwizguide:web_wiz_forums:7.51a:*:*:*:*:*:*:*
cpe:2.3:a:webwizguide:web_wiz_forums:7.92:*:*:*:*:*:*:*
cpe:2.3:a:webwizguide:web_wiz_forums:7.95:*:*:*:*:*:*:*
cpe:2.3:a:webwizguide:web_wiz_forums:7.96:*:*:*:*:*:*:*
cpe:2.3:a:webwizguide:web_wiz_forums:8:beta_1:*:*:*:*:*:*
cpe:2.3:a:webwizguide:web_wiz_forums:8:beta_2:*:*:*:*:*:*
cpe:2.3:a:webwizguide:web_wiz_forums:8:rc1:*:*:*:*:*:*
cpe:2.3:a:webwizguide:web_wiz_forums:8:rc1.1:*:*:*:*:*:*
cpe:2.3:a:webwizguide:web_wiz_forums:8.0:*:*:*:*:*:*:*
cpe:2.3:a:webwizguide:web_wiz_forums:8.01:*:*:*:*:*:*:*
cpe:2.3:a:webwizguide:web_wiz_forums:8.02:*:*:*:*:*:*:*
cpe:2.3:a:webwizguide:web_wiz_forums:8.03:*:*:*:*:*:*:*
cpe:2.3:a:webwizguide:web_wiz_forums:8.04:*:*:*:*:*:*:*
History

21 Nov 2024, 00:28

Type Values Removed Values Added
References () http://ifsec.blogspot.com/2007/03/web-wiz-forums-805-mysql-version-sql.html - Exploit () http://ifsec.blogspot.com/2007/03/web-wiz-forums-805-mysql-version-sql.html - Exploit
References () http://osvdb.org/34344 - () http://osvdb.org/34344 -
References () http://secunia.com/advisories/24561 - Vendor Advisory () http://secunia.com/advisories/24561 - Vendor Advisory
References () http://securityreason.com/securityalert/2456 - Exploit () http://securityreason.com/securityalert/2456 - Exploit
References () http://www.securityfocus.com/archive/1/463287/100/0/threaded - () http://www.securityfocus.com/archive/1/463287/100/0/threaded -
References () http://www.securityfocus.com/bid/23051 - Exploit () http://www.securityfocus.com/bid/23051 - Exploit
References () http://www.vupen.com/english/advisories/2007/1061 - Vendor Advisory () http://www.vupen.com/english/advisories/2007/1061 - Vendor Advisory
References () http://www.webwizguide.info/web_wiz_forums/Version%20History.txt - () http://www.webwizguide.info/web_wiz_forums/Version%20History.txt -
References () https://exchange.xforce.ibmcloud.com/vulnerabilities/33095 - () https://exchange.xforce.ibmcloud.com/vulnerabilities/33095 -
Information

Published : 2007-03-20 22:19

Updated : 2024-11-21 00:28

NVD link : CVE-2007-1548

Mitre link : CVE-2007-1548

CVE.ORG link : CVE-2007-1548

JSON object : View

Products Affected

webwizguide

  • web_wiz_forums
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')