PT-2007-3319 · Unknown+1 · Wf-Section+2

Ajann · Publicado 2007-04-12 · Atualizado 2018-10-16 · CVE-2007-1974

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WF-Section (aka WF-Sections) version 1.0.1 Zmagazine version 1.0 Happy Linux XFsection versions 1.07 and earlier

Description A SQL injection issue exists in the getArticle function in class/wfsarticle.php, allowing remote attackers to execute arbitrary SQL commands via the articleid parameter to "print.php".

Recommendations For WF-Section (aka WF-Sections) version 1.0.1, avoid using the articleid parameter in the affected API endpoint until the issue is resolved. For Zmagazine version 1.0, restrict access to the vulnerable module to minimize the risk of exploitation. For Happy Linux XFsection versions 1.07 and earlier, consider disabling the getArticle function in class/wfsarticle.php as a temporary workaround until a patch is available.

Exploit

Correção

Identificadores relacionados

CVE-2007-1974

Produtos afetados

Happy Linux Xfsection

Wf-Section

Zmagazine

Referências · 20

• 🔥 https://exploit-db.com/exploits/3646 · Exploit
• 🔥 https://exploit-db.com/exploits/3644 · Exploit
• 🔥 https://exploit-db.com/exploits/3645 · Exploit
• http://osvdb.org/41387 · Nota
• http://securityfocus.com/bid/23258 · Nota
• http://securityfocus.com/archive/1/488317/100/0/threaded · Nota
• http://securityfocus.com/bid/23259 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33379 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33380 · Nota
• http://addons.zarilia.com/index.php?page_type=static&id=43 · Correção
• http://vupen.com/english/advisories/2007/1208 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33378 · Nota
• http://vupen.com/english/advisories/2007/1207 · Nota
• http://osvdb.org/52230 · Nota
• http://attrition.org/pipermail/vim/2007-April/001507.html · Aviso do Fabricante