CVE-2007-1548
CVE-2007-1548
SQL injection vulnerability in functions/functions_filters.asp in Web Wiz Forums before 8.05a (MySQL version) does not properly filter certain characters in SQL commands, which allows remote attackers to execute arbitrary SQL commands via \"' (backslash double-quote quote) sequences, which are collapsed into \'', as demonstrated via the name parameter to forum/pop_up_member_search.asp.
Productos afectados
n/a · n/aPoCs públicas encontradas — 1
exploitdbwww.exploit-db.com/exploits/29762no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →Referencias
http://ifsec.blogspot.com/2007/03/web-wiz-forums-805-mysql-version-sql.htmlhttp://osvdb.org/34344http://secunia.com/advisories/24561http://securityreason.com/securityalert/2456https://exchange.xforce.ibmcloud.com/vulnerabilities/33095http://www.securityfocus.com/archive/1/463287/100/0/threadedhttp://www.securityfocus.com/bid/23051http://www.vupen.com/english/advisories/2007/1061http://www.webwizguide.info/web_wiz_forums/Version%20History.txt