CVE-2007-1902

Multiple SQL injection vulnerabilities in SonicBB 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) part and (2) by parameters to (a) search.php, or the (2) id parameter to (b) viewforum.php.

CVSS v2.0 6.8 MEDIUM

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://marc.info/?l=full-disclosure&m=117914598917534&w=2
http://www.netvigilance.com/advisory0019	Exploit Vendor Advisory
http://www.osvdb.org/33907
http://www.securityfocus.com/bid/23964
http://secunia.com/advisories/25279
http://www.vupen.com/english/advisories/2007/1816
https://exchange.xforce.ibmcloud.com/vulnerabilities/34258
http://www.securityfocus.com/archive/1/468536/100/0/threaded

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:a:sonicbb:sonicbb:1.0:*:*:*:*:*:*:*

Information

Published : 2007-05-14 14:19

Updated : 2018-10-16 09:41

NVD link : CVE-2007-1902

Mitre link : CVE-2007-1902

JSON object : View

CWE

NVD-CWE-Other

Advertisement

Products Affected

sonicbb

sonicbb

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://marc.info/?l=full-disclosure&m=117914598917534&w=2", "name": "20070514 SonicBB version 1.0 Multiple SQL Injection Vulnerabilities", "tags": [], "refsource": "FULLDISC"}, {"url": "http://www.netvigilance.com/advisory0019", "name": "http://www.netvigilance.com/advisory0019", "tags": ["Exploit", "Vendor Advisory"], "refsource": "MISC"}, {"url": "http://www.osvdb.org/33907", "name": "33907", "tags": [], "refsource": "OSVDB"}, {"url": "http://www.securityfocus.com/bid/23964", "name": "23964", "tags": [], "refsource": "BID"}, {"url": "http://secunia.com/advisories/25279", "name": "25279", "tags": [], "refsource": "SECUNIA"}, {"url": "http://www.vupen.com/english/advisories/2007/1816", "name": "ADV-2007-1816", "tags": [], "refsource": "VUPEN"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34258", "name": "sonicbb-search-sql-injection(34258)", "tags": [], "refsource": "XF"}, {"url": "http://www.securityfocus.com/archive/1/468536/100/0/threaded", "name": "20070514 SonicBB version 1.0 Multiple SQL Injection Vulnerabilities", "tags": [], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Multiple SQL injection vulnerabilities in SonicBB 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) part and (2) by parameters to (a) search.php, or the (2) id parameter to (b) viewforum.php."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2007-1902", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}}, "publishedDate": "2007-05-14T21:19Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:sonicbb:sonicbb:1.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-16T16:41Z"}