CVE-2007-2598 - SQL injection vulnerability in print.php in SimpleNews 1.0.0 FINAL allows remote attackers to execut

CVE-2007-2598

Summary

SQL injection vulnerability in print.php in SimpleNews 1.0.0 FINAL allows remote attackers to execute arbitrary SQL commands via the news_id parameter.

References

http://www.w4ck1ng.com/exploits/w4ck1ng_simplenews.txt
http://www.securityfocus.com/bid/23904
http://secunia.com/advisories/25223
http://www.vupen.com/english/advisories/2007/1741
http://osvdb.org/35910
https://exchange.xforce.ibmcloud.com/vulnerabilities/34220
https://www.exploit-db.com/exploits/3886

Vulnerable Configurations

cpe:2.3:a:simplenews:simplenews:1.0.0_final:*:*:*:*:*:*:*
cpe:2.3:a:simplenews:simplenews:1.0.0_final:*:*:*:*:*:*:*

CVSS

Base:	10.0 (as of 14-02-2024 - 01:17)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
COMPLETE	COMPLETE	COMPLETE

cvss-vector via4

AV:N/AC:L/Au:N/C:C/I:C/A:C

refmap via4

bid	23904
exploit-db	3886
misc	http://www.w4ck1ng.com/exploits/w4ck1ng_simplenews.txt
osvdb	35910
secunia	25223
vupen	ADV-2007-1741
xf	simplenews-print-sql-injection(34220)

Last major update

14-02-2024 - 01:17

Published

11-05-2007 - 10:19

Last modified

14-02-2024 - 01:17