CVE-2007-4086 - Multiple SQL injection vulnerabilities in AlstraSoft Video Share Enterprise allow remote attackers t

CVE-2007-4086

Summary

Multiple SQL injection vulnerabilities in AlstraSoft Video Share Enterprise allow remote attackers to execute arbitrary SQL commands via (1) the gid parameter to gmembers.php, or (2) the UID parameter to (a) uvideos.php, (b) ugroups.php, (c) uprofile.php, (d) ufavour.php, (e) ufriends.php, or (f) uplaylist.php.

References

http://lostmon.blogspot.com/2007/07/alstrasoft-multiple-products-multiple.html
http://osvdb.org/37872
http://osvdb.org/37873
http://osvdb.org/37874
http://osvdb.org/37875
http://osvdb.org/37876
http://osvdb.org/37877
http://osvdb.org/37878

Vulnerable Configurations

cpe:2.3:a:alstrasoft:video_share_enterprise:*:*:*:*:*:*:*:*
cpe:2.3:a:alstrasoft:video_share_enterprise:*:*:*:*:*:*:*:*

CVSS

Base:	6.8 (as of 15-11-2008 - 06:55)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:M/Au:N/C:P/I:P/A:P

refmap via4

misc	http://lostmon.blogspot.com/2007/07/alstrasoft-multiple-products-multiple.html
osvdb	37872 37873 37874 37875 37876 37877 37878

Last major update

15-11-2008 - 06:55

Published

30-07-2007 - 17:30

Last modified

15-11-2008 - 06:55