PT-2007-2562 · Webmplayer · Webmplayer

Published 2007-02-27 · Updated 2011-03-08 · CVE-2007-1135

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WebMplayer versions prior to 0.6.1-Alpha

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the strid parameter to "index.php" or the id[0] or other id array index parameter to "filecheck.php".

Recommendations For versions prior to 0.6.1-Alpha, update to version 0.6.1-Alpha or later to resolve the issue. As a temporary workaround, consider restricting access to the "index.php" and "filecheck.php" endpoints to minimize the risk of exploitation. Avoid using the strid parameter in "index.php" and the id[0] or other id array index parameters in "filecheck.php" until the issue is resolved.

Fix

Related Identifiers

CVE-2007-1135

Affected Products

Webmplayer

References · 6

• http://sourceforge.net/project/shownotes.php?release_id=486880&group_id=172354 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2007-1135 · Security Note
• http://osvdb.org/34443 · Note
• http://vupen.com/english/advisories/2007/0742 · Note
• http://securityfocus.com/bid/22726 · Note
• http://osvdb.org/34442 · Note