CVE-2007-4086 Multiple SQL injection vulnerabilities in AlstraSoft Video Share Enterprise allow remote attackers to execute arbitrary SQL commands via (1) the gid parameter to gmembers.php, or (2) the UID parameter...

MediumCVSS 6.8 EPSS 1.3%

Published: 2007-07-30 20:00
Updated: 2026-06-17 01:43
Exploit status: No public exploit known

Description

Multiple SQL injection vulnerabilities in AlstraSoft Video Share Enterprise allow remote attackers to execute arbitrary SQL commands via (1) the gid parameter to gmembers.php, or (2) the UID parameter to (a) uvideos.php, (b) ugroups.php, (c) uprofile.php, (d) ufavour.php, (e) ufriends.php, or (f) uplaylist.php.

Affected products

Product	Affected versions	Fixed in
alstrasoft video share enterprise	All versions	No fix listed

References

lostmon.blogspot.com exploit
37872 vdb-entry
37873 vdb-entry
37874 vdb-entry
37875 vdb-entry
37876 vdb-entry
37877 vdb-entry
37878 vdb-entry

CVSS v2.0

6.8 Medium

AV:N/AC:M/Au:N/C:P/I:P/A:P

Access Vector: Network
Access Complexity: Medium
Authentication: None
Confidentiality: Partial
Integrity: Partial
Availability: Partial

Weakness & likelihood

EPSS (exploitation probability, 30 days): 1.34% (percentile 71.6)
CWE: Not classified

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.