CVE-2007-1540 Directory traversal vulnerability in am.pl in (1) SQL-Ledger 2.6.27 and earlier, and (2) LedgerSMB before 1.2.0, allows remote attackers to run arbitrary executables and bypass authentication via a .....
MediumCVSS 4.3
EPSS 5.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Directory traversal vulnerability in am.pl in (1) SQL-Ledger 2.6.27 and earlier, and (2) LedgerSMB before 1.2.0, allows remote attackers to run arbitrary executables and bypass authentication via a .. (dot dot) sequence and trailing NULL (%00) in the login parameter. NOTE: this issue was reportedly addressed in SQL-Ledger 2.6.27, however third-party researchers claim that the file is still executed even though an error is generated.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ledgersmb | <= 1.1.8 | No fix listed |
| sql-ledger | <= 2.6.27 | No fix listed |
| debian/sql-ledger(Debian:12) | < 2.8.14-1 | 2.8.14-1 |
| debian/sql-ledger(Debian:13) | < 2.8.14-1 | 2.8.14-1 |
| debian/sql-ledger(Debian:14) | < 2.8.14-1 | 2.8.14-1 |
References
- Debian Security Tracker CVE-2007-1540 vendor-advisory
- bugs.debian.org issue-tracking
- 24560 third-party-advisory
- 24585 third-party-advisory
- sourceforge.net patch
- sql-ledger.com
- 33624 vdb-entry
- 20070318 Full Disclosure: Arbitrary execution vulnerability in SQL-Ledger and LedgerSMB mailing-list
- 23034 vdb-entry
- ADV-2007-1024 vdb-entry
- ADV-2007-1025 vdb-entry