CVE-2007-1979 SQL injection vulnerability in index.php in the PopnupBlog 2.52 and earlier module for Xoops allows remote attackers to execute arbitrary SQL commands via the postid parameter, possibly involving the....
HighCVSS 7.5
EPSS 2.3%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
SQL injection vulnerability in index.php in the PopnupBlog 2.52 and earlier module for Xoops allows remote attackers to execute arbitrary SQL commands via the postid parameter, possibly involving the get_blogid_from_postid function in class/PopnupBlogUtils.php. NOTE: later versions such as 3.03 and 3.05 might also be affected.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| xoops popnupblog | <= 2.52 | No fix listed |
References
- 24761 third-party-advisory vendor-advisory
- 23286 exploit vdb-entry
- ADV-2007-1206 vdb-entry
- 3655 exploit