CVE-2007-4804

Multiple SQL injection vulnerabilities in AuraCMS 1.5rc allow remote attackers to execute arbitrary SQL commands via the id parameter in (1) hal.php, (2) cetak.php, (3) lihat.php, (4) pesan.php, and (5) teman.php, different vectors than CVE-2007-4171. NOTE: the scripts may be accessed through requests to the product's top-level default URI, using the pilih parameter, in some circumstances.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.securityfocus.com/bid/25614
http://osvdb.org/38409
http://osvdb.org/38412
http://osvdb.org/38410
http://osvdb.org/38413
http://osvdb.org/38411
https://exchange.xforce.ibmcloud.com/vulnerabilities/36519
https://www.exploit-db.com/exploits/4385

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:a:auracms:auracms:1.5_rc:*:*:*:*:*:*:*

Information

Published : 2007-09-11 11:17

Updated : 2017-09-28 18:29

NVD link : CVE-2007-4804

Mitre link : CVE-2007-4804

JSON object : View

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Advertisement

Products Affected

auracms

auracms

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.securityfocus.com/bid/25614", "name": "25614", "tags": [], "refsource": "BID"}, {"url": "http://osvdb.org/38409", "name": "38409", "tags": [], "refsource": "OSVDB"}, {"url": "http://osvdb.org/38412", "name": "38412", "tags": [], "refsource": "OSVDB"}, {"url": "http://osvdb.org/38410", "name": "38410", "tags": [], "refsource": "OSVDB"}, {"url": "http://osvdb.org/38413", "name": "38413", "tags": [], "refsource": "OSVDB"}, {"url": "http://osvdb.org/38411", "name": "38411", "tags": [], "refsource": "OSVDB"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36519", "name": "auracms-multiple-sql-injection(36519)", "tags": [], "refsource": "XF"}, {"url": "https://www.exploit-db.com/exploits/4385", "name": "4385", "tags": [], "refsource": "EXPLOIT-DB"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Multiple SQL injection vulnerabilities in AuraCMS 1.5rc allow remote attackers to execute arbitrary SQL commands via the id parameter in (1) hal.php, (2) cetak.php, (3) lihat.php, (4) pesan.php, and (5) teman.php, different vectors than CVE-2007-4171. NOTE: the scripts may be accessed through requests to the product's top-level default URI, using the pilih parameter, in some circumstances."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-89"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2007-4804", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "HIGH", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}}, "publishedDate": "2007-09-11T18:17Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:auracms:auracms:1.5_rc:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2017-09-29T01:29Z"}