CVE-2007-4210 Multiple SQL injection vulnerabilities in module.php in LANAI (la-nai) CMS 1.2.14 allow remote attackers to execute arbitrary SQL commands via (1) the mid parameter in an faqviewgroup action in the FA...
HighCVSS 7.5
EPSS 2.9%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple SQL injection vulnerabilities in module.php in LANAI (la-nai) CMS 1.2.14 allow remote attackers to execute arbitrary SQL commands via (1) the mid parameter in an faqviewgroup action in the FAQ Modules, (2) the cid parameter in the EZSHOPINGCART Modules, or (3) the gid parameter in a view action in the GALLERY Modules.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redline software lanai cms | = 1.2.14 | No fix listed |
References
- 36438 vdb-entry
- 37470 vdb-entry
- 37471 vdb-entry
- 26339 third-party-advisory
- 2975 third-party-advisory
- 20070802 la-nai cms_v1.2.14 - Remote SQL Injection mailing-list
- 25193 patch vdb-entry
- lanai-module-sql-injection(35786) vdb-entry