PT-2007-2828 · Grayscale · Grayscale Blog

Omnipresent · Published 2007-03-13 · Updated 2018-10-16 · CVE-2007-1434

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Grayscale Blog versions 0.8.0 and earlier

Description A SQL injection issue might allow remote attackers to execute arbitrary SQL commands. This is possible via the id parameter to "userdetail.php", the url parameter to "jump.php", and the id variable to "detail.php".

Recommendations For Grayscale Blog versions 0.8.0 and earlier, avoid using the id parameter in "userdetail.php" and the id variable in "detail.php", and restrict the url parameter in "jump.php" until a fix is available.

Exploit

Fix

Related Identifiers

CVE-2007-1434

Affected Products

Grayscale Blog

References · 6

• 🔥 https://exploit-db.com/exploits/3447 · Exploit
• 🔥 http://securityfocus.com/bid/22911 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-1434 · Security Note
• http://securityfocus.com/archive/1/462441/100/0/threaded · Note
• http://securityreason.com/securityalert/2417 · Note
• http://vupen.com/english/advisories/2007/0916 · Note