PT-2007-3006 · Realguestbook · Realguestbook

Published 2007-03-23 · Updated 2011-03-08 · CVE-2007-1624

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions realGuestbook version 5.01

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved through SQL injection vulnerabilities in the name, email, homepage, and text parameters to save entry.php, which can be reached through add entry.php. There may be other unspecified parameters and files that are also vulnerable.

Recommendations For realGuestbook version 5.01, consider restricting access to the save entry.php file and validating user input for the name, email, homepage, and text parameters to prevent SQL injection attacks. As a temporary workaround, consider disabling the save entry.php file until a patch is available.

Fix

Related Identifiers

CVE-2007-1624

Affected Products

Realguestbook

References · 5

• http://secunia.com/advisories/24602 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-1624 · Security Note
• http://vupen.com/english/advisories/2007/1060 · Note
• http://osvdb.org/34342 · Note
• http://securityfocus.com/bid/23072 · Note