PT-2007-7325 · Kvaliitti · Kvaliitti Webdoc

Chrysalid + 1 · Published 2007-12-20 · Updated 2018-10-15 · CVE-2007-6491

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Kvaliitti WebDoc version 3.0

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the cat id parameter to "categories.asp", and probably via the document id parameter to "categories.asp", as well as the cat id and document id parameters to "subcategory.asp".

Recommendations For Kvaliitti WebDoc version 3.0, consider restricting access to the vulnerable parameters cat id and document id in the affected API endpoints "categories.asp" and "subcategory.asp" until a patch is available. Avoid using these parameters in the respective endpoints to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2007-6491

Affected Products

Kvaliitti Webdoc

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2007-6491 · Security Note
• http://osvdb.org/43709 · Note
• http://osvdb.org/43710 · Note
• http://securityfocus.com/archive/1/484758/100/100/threaded · Note
• http://securityreason.com/securityalert/3473 · Note