PT-2007-2932 · Web Wiz · Web Wiz Forums

Ivan Fratric · Published 2007-03-20 · Updated 2018-10-16 · CVE-2007-1548

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Web Wiz Forums version prior to 8.05a

Description The issue is related to a SQL injection vulnerability. It occurs because certain characters in SQL commands are not properly filtered in the functions/functions filters.asp file. This allows remote attackers to execute arbitrary SQL commands via specific sequences, such as backslash double-quote quote sequences, which are collapsed into another sequence. An example of exploitation is via the name parameter to the /forum/pop up member search.asp API endpoint.

Recommendations For versions prior to 8.05a, update to version 8.05a or later to resolve the issue. As a temporary workaround, consider restricting access to the functions/functions filters.asp file and the /forum/pop up member search.asp API endpoint to minimize the risk of exploitation. Avoid using the name parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2007-1548

Affected Products

Web Wiz Forums

References · 11

• 🔥 http://securityreason.com/securityalert/2456 · Exploit
• 🔥 https://exploit-db.com/exploits/29762 · Exploit
• 🔥 http://securityfocus.com/bid/23051 · Exploit
• 🔥 http://ifsec.blogspot.com/2007/03/web-wiz-forums-805-mysql-version-sql.html · Exploit
• http://secunia.com/advisories/24561 · Vendor Advisory
• http://vupen.com/english/advisories/2007/1061 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-1548 · Security Note
• http://osvdb.org/34344 · Note
• http://securityfocus.com/archive/1/463287/100/0/threaded · Note
• http://webwizguide.info/web_wiz_forums/Version%20History.txt · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33095 · Note