PT-2007-2934 · Phpx · Phpx

Published 2007-03-20 · Updated 2018-10-16 · CVE-2007-1550

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phpx version 3.5.15

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via several parameters to different PHP files, including image id or cat id to "gallery.php", news id to "news.php" or "print.php", news cat id to "news.php", cat id, topic id, or post id to "forums.php", or user id to "users.php".

Recommendations For phpx version 3.5.15, consider restricting access to the vulnerable parameters image id, cat id, news id, news cat id, cat id, topic id, post id, and user id in their respective PHP files until a patch is available. As a temporary workaround, disabling the execution of arbitrary SQL commands via these parameters can help minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2007-1550

Affected Products

Phpx

References · 17

• 🔥 https://exploit-db.com/exploits/29756 · Exploit
• 🔥 https://exploit-db.com/exploits/29757 · Exploit
• 🔥 https://exploit-db.com/exploits/29759 · Exploit
• 🔥 https://exploit-db.com/exploits/29760 · Exploit
• 🔥 https://exploit-db.com/exploits/29758 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-1550 · Security Note
• http://osvdb.org/34416 · Note
• http://osvdb.org/34414 · Note
• http://osvdb.org/34415 · Note
• http://vupen.com/english/advisories/2007/1087 · Note
• http://osvdb.org/34418 · Note
• http://securityreason.com/securityalert/2457 · Note
• http://securityfocus.com/archive/1/463192/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33155 · Note
• http://osvdb.org/34417 · Note