CVE-2007-1548 SQL injection vulnerability in functions/functions_filters.asp in Web Wiz Forums before 8.05a (MySQL version) does not properly filter certain characters in SQL commands, which allows remote attackers...
HighCVSS 7.5
EPSS 1.8%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
SQL injection vulnerability in functions/functions_filters.asp in Web Wiz Forums before 8.05a (MySQL version) does not properly filter certain characters in SQL commands, which allows remote attackers to execute arbitrary SQL commands via "' (backslash double-quote quote) sequences, which are collapsed into '', as demonstrated via the name parameter to forum/pop_up_member_search.asp.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| webwizguide web wiz forums | <= 8.05 | No fix listed |
| webwizguide web wiz forums | = 5.21 | No fix listed |
| webwizguide web wiz forums | = 5.22 | No fix listed |
| webwizguide web wiz forums | = 6-beta_1 | No fix listed |
| webwizguide web wiz forums | = 6-beta_2 | No fix listed |
| webwizguide web wiz forums | = 6-beta_3 | No fix listed |
| webwizguide web wiz forums | = 6-beta_4 | No fix listed |
| webwizguide web wiz forums | = 6-beta_5 | No fix listed |
| webwizguide web wiz forums | = 6-beta_6 | No fix listed |
| webwizguide web wiz forums | = 6.0 | No fix listed |
| webwizguide web wiz forums | = 6.10 | No fix listed |
| webwizguide web wiz forums | = 6.11 | No fix listed |
| webwizguide web wiz forums | = 6.12 | No fix listed |
| webwizguide web wiz forums | = 6.20 | No fix listed |
| webwizguide web wiz forums | = 6.21 | No fix listed |
| webwizguide web wiz forums | = 6.22 | No fix listed |
| webwizguide web wiz forums | = 6.23 | No fix listed |
| webwizguide web wiz forums | = 6.24 | No fix listed |
| webwizguide web wiz forums | = 6.25 | No fix listed |
| webwizguide web wiz forums | = 6.26 | No fix listed |
| webwizguide web wiz forums | = 6.27 | No fix listed |
| webwizguide web wiz forums | = 6.28 | No fix listed |
| webwizguide web wiz forums | = 6.29 | No fix listed |
| webwizguide web wiz forums | = 6.30 | No fix listed |
| webwizguide web wiz forums | = 6.32 | No fix listed |
Show 27 more
| Product | Affected versions | Fixed in |
|---|---|---|
| webwizguide web wiz forums | = 6.33 | No fix listed |
| webwizguide web wiz forums | = 6.34 | No fix listed |
| webwizguide web wiz forums | = 7-beta_4 | No fix listed |
| webwizguide web wiz forums | = 7-rc1 | No fix listed |
| webwizguide web wiz forums | = 7.0 | No fix listed |
| webwizguide web wiz forums | = 7.01 | No fix listed |
| webwizguide web wiz forums | = 7.5 | No fix listed |
| webwizguide web wiz forums | = 7.5-beta_1 | No fix listed |
| webwizguide web wiz forums | = 7.6 | No fix listed |
| webwizguide web wiz forums | = 7.7 | No fix listed |
| webwizguide web wiz forums | = 7.7a | No fix listed |
| webwizguide web wiz forums | = 7.8 | No fix listed |
| webwizguide web wiz forums | = 7.9 | No fix listed |
| webwizguide web wiz forums | = 7.51 | No fix listed |
| webwizguide web wiz forums | = 7.51a | No fix listed |
| webwizguide web wiz forums | = 7.92 | No fix listed |
| webwizguide web wiz forums | = 7.95 | No fix listed |
| webwizguide web wiz forums | = 7.96 | No fix listed |
| webwizguide web wiz forums | = 8-beta_1 | No fix listed |
| webwizguide web wiz forums | = 8-beta_2 | No fix listed |
| webwizguide web wiz forums | = 8-rc1 | No fix listed |
| webwizguide web wiz forums | = 8-rc1.1 | No fix listed |
| webwizguide web wiz forums | = 8.0 | No fix listed |
| webwizguide web wiz forums | = 8.01 | No fix listed |
| webwizguide web wiz forums | = 8.02 | No fix listed |
| webwizguide web wiz forums | = 8.03 | No fix listed |
| webwizguide web wiz forums | = 8.04 | No fix listed |
References
- ifsec.blogspot.com exploit
- 34344 vdb-entry
- 24561 third-party-advisory vendor-advisory
- 2456 exploit third-party-advisory
- 20070320 Web Wiz Forums 8.05 (MySQL version) SQL Injection mailing-list
- 23051 exploit vdb-entry
- ADV-2007-1061 vdb-entry vendor-advisory
- www.webwizguide.info
- webwizforums-popupmember-sql-injection(33095) vdb-entry