PT-2007-2984 · Unknown · Weekly Drawing Contest

Published 2007-03-22 · Updated 2018-10-16 · CVE-2007-1602

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Weekly Drawing Contest version 0.0.1

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the order parameter in the check vote.php file.

Recommendations For Weekly Drawing Contest version 0.0.1, avoid using the order parameter in the check vote.php file until a fix is available. Consider restricting access to the check vote.php file to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2007-1602

Affected Products

Weekly Drawing Contest

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2007-1602 · Security Note
• http://securityreason.com/securityalert/2453 · Note
• http://securityfocus.com/archive/1/462702/100/100/threaded · Note