PT-2007-2405 · Webtester · Webtester

Moran Zavdi · Published 2007-02-16 · Updated 2018-10-16 · CVE-2007-0970

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: WebTester versions 5.0.20060927 and earlier

Description: The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the testID parameter to "directions.php", and unspecified parameters to other files that accept GET or POST input.

Recommendations: For versions 5.0.20060927 and earlier, avoid using the testID parameter in the "directions.php" file until the issue is resolved. Restrict access to files that accept GET or POST input to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2007-0970

Affected Products

Webtester

References · 10

• 🔥 https://exploit-db.com/exploits/29602 · Exploit
• 🔥 http://securityfocus.com/bid/22559 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-0970 · Security Note
• http://vupen.com/english/advisories/2007/0633 · Note
• http://securityreason.com/securityalert/2261 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32490 · Note
• http://osvdb.org/33204 · Note
• http://secunia.com/advisories/24157 · Note
• http://osvdb.org/33203 · Note
• http://securityfocus.com/archive/1/460078/100/0/threaded · Note