high7.5Public exploit code
CVE-2007-1363
Multiple SQL injection vulnerabilities in DropAFew before 0.2.1 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in the delete…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- DropAFew 0.2 - 'editlogcal.php?save Action calories' SQL Injection2007-04-10 · webapps · php · Verified
- DropAFew 0.2 - 'search.php?delete Action id' SQL Injection2007-04-10 · webapps · php · Verified
Impact
Multiple SQL injection vulnerabilities in DropAFew before 0.2.1 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in the delete action in (a) search.php or (b) search-pda.php, or the (2) calories parameter in a save action in editlogcal.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dropafew | Dropafew | through 0.2 |
References
- NVD record
- CVE.org record
- http://secunia.com/advisories/24861
- http://www.cynops.de/advisories/CVE-2007-1363.txt
- http://www.dropafew.com/sphpblog/comments.php?y=07&m=04&entry=entry070403-224437
- http://www.securityfocus.com/bid/23400
- https://exchange.xforce.ibmcloud.com/vulnerabilities/33560
- http://secunia.com/advisories/24861
- http://www.cynops.de/advisories/CVE-2007-1363.txt
- http://www.dropafew.com/sphpblog/comments.php?y=07&m=04&entry=entry070403-224437
- http://www.securityfocus.com/bid/23400
- https://exchange.xforce.ibmcloud.com/vulnerabilities/33560