CVE-2007-2911 SQL injection vulnerability in admincp/attachment.php in Jelsoft vBulletin before 3.6.6 allows remote authenticated administrators to execute arbitrary SQL commands via the "Attached After" field (GPC...
HighCVSS 8.5
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
SQL injection vulnerability in admincp/attachment.php in Jelsoft vBulletin before 3.6.6 allows remote authenticated administrators to execute arbitrary SQL commands via the "Attached After" field (GPC['search']['datelineafter'] variable), a related issue to CVE-2007-1573.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jelsoft vbulletin | <= 3.6.5 | No fix listed |
References
- 38147 vdb-entry
- www.vbulletin.com patch
- vbulletin-attachedafter-sql-injection(34784) vdb-entry