CVE-2007-2299 - Multiple SQL injection vulnerabilities in Frogss CMS 0.7 and earlier allow remote attackers to execu

CVE-2007-2299

Summary

Multiple SQL injection vulnerabilities in Frogss CMS 0.7 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) dzial parameter to (a) katalog.php, or the (2) t parameter to (b) forum.php or (c) forum/viewtopic.php, different vectors than CVE-2006-4536.

References

http://osvdb.org/35526
http://osvdb.org/35527
http://osvdb.org/35528
http://www.securityfocus.com/bid/23476
http://www.vupen.com/english/advisories/2007/1388
https://exchange.xforce.ibmcloud.com/vulnerabilities/33640
https://www.exploit-db.com/exploits/3731

Vulnerable Configurations

cpe:2.3:a:frogss:frogss_cms:*:*:*:*:*:*:*:*
cpe:2.3:a:frogss:frogss_cms:*:*:*:*:*:*:*:*

CVSS

Base:	7.5 (as of 11-10-2017 - 01:32)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:L/Au:N/C:P/I:P/A:P

refmap via4

bid	23476
exploit-db	3731
osvdb	35526 35527 35528
vupen	ADV-2007-1388
xf	frogsscms-katalog-sql-injection(33640)

Last major update

11-10-2017 - 01:32

Published

26-04-2007 - 21:19

Last modified

11-10-2017 - 01:32