PT-2007-4411 · Wsportal · Wsportal

Jesper Jurcenoks · Published 2007-06-19 · Updated 2018-10-16 · CVE-2007-3128

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: WSPortal version 1.0

Description: A SQL injection issue exists in the content.php file of WSPortal, allowing remote attackers to execute arbitrary SQL commands when magic quotes gpc is disabled. This is achieved by manipulating the page parameter.

Recommendations: For WSPortal version 1.0, consider disabling the content.php file or restricting access to it until a patch is available. Additionally, enabling magic quotes gpc can help mitigate this issue.

Fix

Related Identifiers

CVE-2007-3128

Affected Products

Wsportal

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2007-3128 · Security Note
• http://netvigilance.com/advisory0033 · Note
• http://archives.neohapsis.com/archives/fulldisclosure/2007-06/0369.html · Note
• http://osvdb.org/34164 · Note
• http://vupen.com/english/advisories/2007/2237 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34896 · Note
• http://securityfocus.com/archive/1/471629/100/0/threaded · Note
• http://securityfocus.com/bid/24513 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3128 · Note