← back
CVE-2007-1540

CVE-2007-1540

EPSS 4.9%
Directory traversal vulnerability in am.pl in (1) SQL-Ledger 2.6.27 and earlier, and (2) LedgerSMB before 1.2.0, allows remote attackers to run arbitrary executables and bypass authentication via a .. (dot dot) sequence and trailing NULL (%00) in the login parameter. NOTE: this issue was reportedly addressed in SQL-Ledger 2.6.27, however third-party researchers claim that the file is still executed even though an error is generated.
Affected products
n/a · n/a
public PoCs found — 1
exploitdbwww.exploit-db.com/exploits/29761unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://secunia.com/advisories/24560http://secunia.com/advisories/24585http://sourceforge.net/project/shownotes.php?release_id=494462&group_id=175965http://sql-ledger.com/cgi-bin/nav.pl?page=news.html&title=What%27s%20Newhttp://www.osvdb.org/33624http://www.securityfocus.com/archive/1/463175/100/0/threadedhttp://www.securityfocus.com/bid/23034http://www.vupen.com/english/advisories/2007/1024http://www.vupen.com/english/advisories/2007/1025