PT-2007-2958 · Phprojekt · Phprojekt

Published 2007-03-21 · Updated 2018-10-16 · CVE-2007-1575

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHProjekt version 5.2.0

Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is possible due to multiple SQL injection vulnerabilities when the magic quotes gpc setting is disabled. The vulnerabilities are found in the calendar and search modules, as well as in an unspecified cookie when the user logs out.

Recommendations For PHProjekt version 5.2.0, consider disabling the calendar and search modules until a patch is available. Additionally, restrict access to the logout functionality to minimize the risk of exploitation. As a temporary workaround, enable the magic quotes gpc setting to prevent SQL injection attacks.

Fix

Related Identifiers

CVE-2007-1575

Affected Products

Phprojekt

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2007-1575 · Security Note
• http://phprojekt.com/index.php?name=News&file=article&sid=276 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200706-07.xml · Vendor Advisory
• http://nruns.com/security_advisory_phprojekt_sql_injection.php · Vendor Advisory
• http://securityfocus.com/bid/22955 · Note
• http://secunia.com/advisories/24509 · Note
• http://secunia.com/advisories/25748 · Note
• http://securityfocus.com/archive/1/462789/100/0/threaded · Note
• http://securityreason.com/securityalert/2466 · Note