high7.5Public exploit code
CVE-2007-3394
Multiple SQL injection vulnerabilities in eNdonesia 8.4 allow remote attackers to execute arbitrary SQL commands via the (1) artid parameter to mod.php in a vi…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- eNdonesia 8.4 - 'banners.php?click Action bid' SQL Injection2007-06-22 · webapps · php · Verified
- eNdonesia 8.4 - 'mod.php?viewarticle Action artid' SQL Injection2007-06-22 · webapps · php · Verified
Impact
Multiple SQL injection vulnerabilities in eNdonesia 8.4 allow remote attackers to execute arbitrary SQL commands via the (1) artid parameter to mod.php in a viewarticle action (publisher mod) and the (2) bid parameter to banners.php in a click action. NOTE: the mod.php viewdisk and viewlink vectors are already covered by CVE-2006-6873.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Endonesia | Endonesia | Version 8.4 |
References
- NVD record
- CVE.org record
- http://osvdb.org/38227
- http://osvdb.org/38228
- http://securityreason.com/securityalert/2839
- http://www.securityfocus.com/archive/1/472022/100/0/threaded
- http://www.securityfocus.com/bid/24590
- http://osvdb.org/38227
- http://osvdb.org/38228
- http://securityreason.com/securityalert/2839
- http://www.securityfocus.com/archive/1/472022/100/0/threaded
- http://www.securityfocus.com/bid/24590