CVE-2007-4956 Multiple SQL injection vulnerabilities in KwsPHP 1.0 allow remote attackers to execute arbitrary SQL commands via (1) the pseudo parameter to login.php, (2) the id parameter to index.php in a carnet e...
HighCVSS 7.5
EPSS 3.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple SQL injection vulnerabilities in KwsPHP 1.0 allow remote attackers to execute arbitrary SQL commands via (1) the pseudo parameter to login.php, (2) the id parameter to index.php in a carnet editer action in the Member_Space (espace_membre) module, or (3) the typenav parameter to index.php in a browser aff action in the stats module.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| kwsphp | = 1.0 | No fix listed |
References
- koogar.alorys-hebergement.com
- 37180 vdb-entry
- 37182 vdb-entry
- 26850 third-party-advisory
- 25679 vdb-entry
- kwsphp-stats-index-sql-injection(36634) vdb-entry
- kwsphp-memberspace-index-sql-injection(36635) vdb-entry
- kwsphp-login-sql-injection(36636) vdb-entry
- 4412 exploit
- 4413 exploit
- 4414 exploit