CVE-2007-4804

EPSS 3.3%

Multiple SQL injection vulnerabilities in AuraCMS 1.5rc allow remote attackers to execute arbitrary SQL commands via the id parameter in (1) hal.php, (2) cetak.php, (3) lihat.php, (4) pesan.php, and (5) teman.php, different vectors than CVE-2007-4171. NOTE: the scripts may be accessed through requests to the product's top-level default URI, using the pilih parameter, in some circumstances.

Affected products

n/a · n/a

public PoCs found — 1

cve_referencewww.exploit-db.com/exploits/4385unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://osvdb.org/38409 http://osvdb.org/38410 http://osvdb.org/38411 http://osvdb.org/38412 http://osvdb.org/38413 https://exchange.xforce.ibmcloud.com/vulnerabilities/36519 https://www.exploit-db.com/exploits/4385 http://www.securityfocus.com/bid/25614