PT-2007-3421 · Php+2 · Php+2

Retrogod · Published 2007-04-18 · Updated 2017-10-11 · CVE-2007-2079

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions XAMPP versions 1.6.0a and earlier

Description The issue concerns the ADONewConnection Connect function in adodb.php, which uses untrusted input for the database server hostname. This allows remote attackers to potentially trigger a library buffer overflow and execute arbitrary code via a long host parameter. The impact of this issue could also be unspecified.

Recommendations For XAMPP versions 1.6.0a and earlier, consider updating to a newer version that addresses this issue, although the exact fix might be argued to be in other products such as PHP or the ADOdb Library. As a temporary workaround, restrict the input for the database server hostname to prevent potential buffer overflow attacks.

Exploit

Fix

Related Identifiers

CVE-2007-2079

Affected Products

Adodb Library

Php

Xampp

References · 6

• 🔥 https://exploit-db.com/exploits/3738 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-2079 · Security Note
• http://osvdb.org/41594 · Note
• http://securityfocus.com/bid/23491 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33683 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2079 · Note