← back
CVE-2007-0347

CVE-2007-0347

EPSS 3.6%
The is_eow function in format.c in CVSTrac before 2.0.1 does not properly check for the "'" (quote) character, which allows remote authenticated users to execute limited SQL injection attacks and cause a denial of service (database error) via a ' character in certain messages, tickets, or Wiki entries.
Affected products
n/a · n/a
public PoCs found — 1
exploitdbwww.exploit-db.com/exploits/3223unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://lists.grok.org.uk/pipermail/full-disclosure/2007-January/052058.htmlhttp://osvdb.org/31935http://secunia.com/advisories/23940http://securityreason.com/securityalert/2192http://www.cvstrac.org/cvstrac/chngview?cn=850http://www.cvstrac.org/cvstrac/tktview?tn=683http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.008.htmlhttp://www.securityfocus.com/archive/1/458455/100/0/threadedhttp://www.securityfocus.com/bid/22296http://www.vupen.com/english/advisories/2007/0398