PT-2007-7092 · Neocrome · Neocrome Seditio Cms

Inateam · Published 2007-12-01 · Updated 2017-09-29 · CVE-2007-6202

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Neocrome Seditio CMS versions 121 and earlier

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the pag sub[] parameter to "plug.php".

Recommendations For Neocrome Seditio CMS versions 121 and earlier, update to a version later than 121 to resolve the issue. As a temporary workaround, consider restricting access to the "plug.php" endpoint to minimize the risk of exploitation. Avoid using the pag sub[] parameter in the affected endpoint until the issue is resolved.

Exploit

Fix

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2007-6202

Affected Products

Neocrome Seditio Cms

References · 8

• 🔥 http://securityfocus.com/bid/26655 · Exploit
• 🔥 https://exploit-db.com/exploits/4678 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-6202 · Security Note
• http://neocrome.net/page.php?id=2349 · Patch
• http://secunia.com/advisories/27881 · Vendor Advisory
• http://osvdb.org/38924 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6202 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/38774 · Note