CVE-2007-3677 Multiple SQL injection vulnerabilities in Maxsi eVisit Analyst allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) idsp1.pl, (2) ip.pl, and (3) einsite_director.pl. NO...
HighCVSS 7.5
EPSS 2.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple SQL injection vulnerabilities in Maxsi eVisit Analyst allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) idsp1.pl, (2) ip.pl, and (3) einsite_director.pl. NOTE: this issue can be leveraged for path disclosure from resulting error messages.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| maxsi evisit analyst | All versions | No fix listed |
References
- 26110 third-party-advisory vendor-advisory
- 20070718 Vendor ACK for CVE-2007-3677 (eVisit Analyst) mailing-list
- www.nth-dimension.org.uk
- 36112 vdb-entry
- 36113 vdb-entry
- 36114 vdb-entry
- www.portcullis.co.uk
- 24849 vdb-entry
- evisit-analyst-id-sql-injection(35481) vdb-entry
- evisit-analyst-id-path-disclosure(35482) vdb-entry