CVE-2007-1550

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

• PHPX 3.5.15/3.5.16 - 'gallery.php' SQL Injection2007-03-19 · webapps · php · Verified
• PHPX 3.5.15/3.5.16 - 'news.php' SQL Injection2007-03-19 · webapps · php · Verified
• PHPX 3.5.15/3.5.16 - 'users.php' SQL Injection2007-03-19 · webapps · php · Verified
• PHPX 3.5.15/3.5.16 - 'forums.php' SQL Injection2007-03-19 · webapps · php · Verified
• PHPX 3.5.15/3.5.16 - 'print.php' SQL Injection2007-03-19 · webapps · php · Verified

Impact

Multiple SQL injection vulnerabilities in phpx 3.5.15 allow remote attackers to execute arbitrary SQL commands via the (1) image_id or (2) cat_id parameter to (a) gallery.php; the (3) news_id parameter to (b) news.php or (c) print.php; (4) the news_cat_id parameter to news.php; the (5) cat_id, (6) topic_id, or (7) post_id parameter to (d) forums.php; or (8) the user_id parameter to (e) users.php.

Affected products

References

• NVD record
• CVE.org record
• http://osvdb.org/34414
• http://osvdb.org/34415
• http://osvdb.org/34416
• http://osvdb.org/34417
• http://osvdb.org/34418
• http://secunia.com/advisories/24565
• http://securityreason.com/securityalert/2457
• http://www.securityfocus.com/archive/1/463192/100/0/threaded
• http://www.securityfocus.com/bid/23033
• http://www.vupen.com/english/advisories/2007/1087
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33155
• http://osvdb.org/34414
• http://osvdb.org/34415
• http://osvdb.org/34416
• http://osvdb.org/34417
• http://osvdb.org/34418
• http://secunia.com/advisories/24565
• http://securityreason.com/securityalert/2457
• http://www.securityfocus.com/archive/1/463192/100/0/threaded
• http://www.securityfocus.com/bid/23033
• http://www.vupen.com/english/advisories/2007/1087
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33155