PT-2007-4529 · Elxis · Elxis Cms

Nico Leidecker · Published 2007-06-18 · Updated 2018-10-16 · CVE-2007-3250

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Elxis CMS versions prior to 2006.4 20070613

Description: The issue allows remote attackers to execute arbitrary SQL commands via the mb tracker cookie in the mod banners.php file. This can lead to unauthorized access and manipulation of database content. The product was patched without updating the version number, so later downloads of version 2006.4 are not affected.

Recommendations: For versions prior to 2006.4 20070613, as a temporary workaround, consider restricting access to the mod banners.php file until a patched version can be downloaded. Avoid using the mb tracker cookie in the affected module to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2007-3250

Affected Products

Elxis Cms

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2007-3250 · Security Note
• http://elxis.org/index.php?option=com_mtree&task=viewlink&link_id=98&Itemid=140 · Patch
• http://securityfocus.com/bid/24478 · Patch
• http://vupen.com/english/advisories/2007/2218 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3250 · Note
• http://securityfocus.com/archive/1/471399/100/0/threaded · Note
• http://securityreason.com/securityalert/2806 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34873 · Note
• http://secunia.com/advisories/25684 · Note
• http://osvdb.org/36305 · Note