CVE-2007-1493 nukesentinel.php in NukeSentinel 2.5.06 and earlier uses a permissive regular expression to validate an IP address, which allows remote attackers to execute arbitrary SQL commands via the Client-IP HT...
HighCVSS 7.5
EPSS 3.4%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
nukesentinel.php in NukeSentinel 2.5.06 and earlier uses a permissive regular expression to validate an IP address, which allows remote attackers to execute arbitrary SQL commands via the Client-IP HTTP header, due to an incomplete patch for CVE-2007-1172.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nukescripts nukesentinel | <= 2.5.06 | No fix listed |
References
- 20070314 SQL injection (x2) in NukeSentinel exploit mailing-list
- 2430 third-party-advisory
- 20070310 NukeSentinel <= 2.5.06 SQL Injection (mysql >= 4.0.24) Exploit mailing-list