CVE-2007-1550

EPSS 2.0%

Multiple SQL injection vulnerabilities in phpx 3.5.15 allow remote attackers to execute arbitrary SQL commands via the (1) image_id or (2) cat_id parameter to (a) gallery.php; the (3) news_id parameter to (b) news.php or (c) print.php; (4) the news_cat_id parameter to news.php; the (5) cat_id, (6) topic_id, or (7) post_id parameter to (d) forums.php; or (8) the user_id parameter to (e) users.php.

Affected products

n/a · n/a

public PoCs found — 5

exploitdbwww.exploit-db.com/exploits/29757unverified exploitdbwww.exploit-db.com/exploits/29760unverified exploitdbwww.exploit-db.com/exploits/29759unverified exploitdbwww.exploit-db.com/exploits/29756unverified exploitdbwww.exploit-db.com/exploits/29758unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://osvdb.org/34414 http://osvdb.org/34415 http://osvdb.org/34416 http://osvdb.org/34417 http://osvdb.org/34418 http://secunia.com/advisories/24565 http://securityreason.com/securityalert/2457 https://exchange.xforce.ibmcloud.com/vulnerabilities/33155 http://www.securityfocus.com/archive/1/463192/100/0/threaded http://www.securityfocus.com/bid/23033 http://www.vupen.com/english/advisories/2007/1087