CVE-2007-2312 Multiple SQL injection vulnerabilities in the Virtual War (VWar) 1.5.0 R15 module for PHP-Nuke allow remote attackers to execute arbitrary SQL commands via the n parameter to extra/online.php and othe...
HighCVSS 7.5
EPSS 1.2%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple SQL injection vulnerabilities in the Virtual War (VWar) 1.5.0 R15 module for PHP-Nuke allow remote attackers to execute arbitrary SQL commands via the n parameter to extra/online.php and other unspecified scripts in extra/. NOTE: this might be same vulnerability as CVE-2006-4142; however, there is an intervening vendor fix announcement.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vwar virtual war | = 1.5.0_r15 | No fix listed |
References
- 2642 third-party-advisory
- 20070413 DUP?: [waraxe-2007-SA#048] - Multiple vulnerabilities in Virtual War 1.5 module for PhpNuke exploit mailing-list
- 20070413 [waraxe-2007-SA#048] - Multiple vulnerabilities in Virtual War 1.5 module for PhpNuke mailing-list
- 23478 exploit vdb-entry
- www.waraxe.us exploit
- vwar-online-sql-injection(33649) vdb-entry