PT-2007-1025 · Zoph · Zoph

Published 2007-07-19 · Updated 2017-07-29 · CVE-2007-3905

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Zoph versions prior to 0.7.0.1

Description: The issue allows remote attackers to execute arbitrary SQL commands, potentially leading to disruption of confidentiality, integrity, and availability of protected information. This can be achieved via the order parameter to specific API endpoints, such as "photos.php" and "edit photos.php". The estimated number of potentially affected devices worldwide is not specified. Details about real-world incidents where this issue was exploited are not provided.

Recommendations: For Zoph versions prior to 0.7.0.1, update to version 0.7.0.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the order parameter in the affected API endpoints "photos.php" and "edit photos.php" until a patch is available.

Fix

Related Identifiers

BDU:2015-02860

CVE-2007-3905

DSA-1389-1

DSA-1389-2

Affected Products

Zoph

References · 14

• https://osv.dev/vulnerability/DEBIAN-CVE-2007-3905 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2007-3905 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-3905 · Security Note
• http://secunia.com/advisories/26077 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3905 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2007-3905 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-02860 · Security Note
• http://debian.org/security/2007/dsa-1389 · Vendor Advisory
• http://debian.org/security/dsa-1389 · Note
• http://securityfocus.com/bid/24933 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35446 · Note
• http://sourceforge.net/project/shownotes.php?release_id=523104&group_id=69353 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3905 · Note
• http://secunia.com/advisories/27303 · Note