high7.5Public exploit code
CVE-2007-1434
SQL injection vulnerability in Grayscale Blog 0.8.0, and possibly earlier versions, might allow remote attackers to execute arbitrary SQL commands via the (1) …
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Grayscale Blog 0.8.0 - Security Bypass / SQL Injection / Cross-Site Scripting2007-03-09 · webapps · php · Verified
Impact
SQL injection vulnerability in Grayscale Blog 0.8.0, and possibly earlier versions, might allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to (a) userdetail.php, id and (2) url parameter to (b) jump.php, and id variable to (c) detail.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Grayscale | Grayscale Blog | through 0.8.0 |
References
- NVD record
- CVE.org record
- http://securityreason.com/securityalert/2417
- http://www.securityfocus.com/archive/1/462441/100/0/threaded
- http://www.securityfocus.com/bid/22911
- http://www.vupen.com/english/advisories/2007/0916
- http://securityreason.com/securityalert/2417
- http://www.securityfocus.com/archive/1/462441/100/0/threaded
- http://www.securityfocus.com/bid/22911
- http://www.vupen.com/english/advisories/2007/0916