PT-2007-6282 · X Script · X-Script Guestbook

Published 2007-10-03 · Updated 2018-10-15 · CVE-2007-5189

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions x-script GuestBook version 1.3a

Description The issue concerns SQL injection vulnerabilities in the mes add.php file of x-script GuestBook. When magic quotes gpc is disabled, remote attackers can execute arbitrary SQL commands by manipulating the name, email, icq, and website parameters.

Recommendations For x-script GuestBook version 1.3a, consider disabling the mes add.php file or restricting access to it until a patch is available. As a temporary workaround, enable magic quotes gpc to prevent SQL injection attacks. Avoid using the name, email, icq, and website parameters in the affected file until the issue is resolved.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2007-5189

Affected Products

X-Script Guestbook

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2007-5189 · Security Note
• http://securityreason.com/securityalert/3186 · Note
• http://vupen.com/english/advisories/2007/3347 · Note
• http://securityfocus.com/archive/1/481209/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36895 · Note
• http://securityfocus.com/bid/25890 · Note