CVE-2007-5372 Multiple SQL injection vulnerabilities in (a) LedgerSMB 1.0.0 through 1.2.7 and (b) DWS Systems SQL-Ledger 2.x allow remote attackers to execute arbitrary SQL commands via (1) the invoice quantity fie...
HighCVSS 10.0
EPSS 2.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple SQL injection vulnerabilities in (a) LedgerSMB 1.0.0 through 1.2.7 and (b) DWS Systems SQL-Ledger 2.x allow remote attackers to execute arbitrary SQL commands via (1) the invoice quantity field or (2) the sort field.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dws systems inc sql-ledger | = 2.2.0 | No fix listed |
| dws systems inc sql-ledger | = 2.2.1 | No fix listed |
| dws systems inc sql-ledger | = 2.2.2 | No fix listed |
| dws systems inc sql-ledger | = 2.2.3 | No fix listed |
| dws systems inc sql-ledger | = 2.2.4 | No fix listed |
| dws systems inc sql-ledger | = 2.2.5 | No fix listed |
| dws systems inc sql-ledger | = 2.2.6 | No fix listed |
| dws systems inc sql-ledger | = 2.2.7 | No fix listed |
| dws systems inc sql-ledger | = 2.4.0 | No fix listed |
| dws systems inc sql-ledger | = 2.4.1 | No fix listed |
| dws systems inc sql-ledger | = 2.4.2 | No fix listed |
| dws systems inc sql-ledger | = 2.4.3 | No fix listed |
| dws systems inc sql-ledger | = 2.4.4 | No fix listed |
| dws systems inc sql-ledger | = 2.4.5 | No fix listed |
| dws systems inc sql-ledger | = 2.4.6 | No fix listed |
| dws systems inc sql-ledger | = 2.4.7 | No fix listed |
| dws systems inc sql-ledger | = 2.4.8 | No fix listed |
| dws systems inc sql-ledger | = 2.4.9 | No fix listed |
| dws systems inc sql-ledger | = 2.4.10 | No fix listed |
| dws systems inc sql-ledger | = 2.4.11 | No fix listed |
| dws systems inc sql-ledger | = 2.4.12 | No fix listed |
| dws systems inc sql-ledger | = 2.4.13 | No fix listed |
| dws systems inc sql-ledger | = 2.4.14 | No fix listed |
| dws systems inc sql-ledger | = 2.4.15 | No fix listed |
| dws systems inc sql-ledger | = 2.4.16 | No fix listed |
Show 38 more
| Product | Affected versions | Fixed in |
|---|---|---|
| dws systems inc sql-ledger | = 2.6.1 | No fix listed |
| dws systems inc sql-ledger | = 2.6.2 | No fix listed |
| dws systems inc sql-ledger | = 2.6.3 | No fix listed |
| dws systems inc sql-ledger | = 2.6.4 | No fix listed |
| dws systems inc sql-ledger | = 2.6.5 | No fix listed |
| dws systems inc sql-ledger | = 2.6.6 | No fix listed |
| dws systems inc sql-ledger | = 2.6.7 | No fix listed |
| dws systems inc sql-ledger | = 2.6.8 | No fix listed |
| dws systems inc sql-ledger | = 2.6.9 | No fix listed |
| dws systems inc sql-ledger | = 2.6.10 | No fix listed |
| dws systems inc sql-ledger | = 2.6.11 | No fix listed |
| dws systems inc sql-ledger | = 2.6.12 | No fix listed |
| dws systems inc sql-ledger | = 2.6.13 | No fix listed |
| dws systems inc sql-ledger | = 2.6.14 | No fix listed |
| dws systems inc sql-ledger | = 2.6.15 | No fix listed |
| dws systems inc sql-ledger | = 2.6.16 | No fix listed |
| dws systems inc sql-ledger | = 2.6.17 | No fix listed |
| dws systems inc sql-ledger | = 2.6.18 | No fix listed |
| dws systems inc sql-ledger | = 2.6.27 | No fix listed |
| ledgersmb | = 1.0.0 | No fix listed |
| ledgersmb | = 1.1.0 | No fix listed |
| ledgersmb | = 1.1.1 | No fix listed |
| ledgersmb | = 1.1.5 | No fix listed |
| ledgersmb | = 1.1.8 | No fix listed |
| ledgersmb | = 1.2.0 | No fix listed |
| ledgersmb | = 1.2.1 | No fix listed |
| ledgersmb | = 1.2.2 | No fix listed |
| ledgersmb | = 1.2.3 | No fix listed |
| ledgersmb | = 1.2.4 | No fix listed |
| ledgersmb | = 1.2.5 | No fix listed |
| ledgersmb | = 1.2.6 | No fix listed |
| ledgersmb | = 1.2.7 | No fix listed |
| debian/sql-ledger(Debian:12) | All versions | No fix listed |
| debian/sql-ledger(Debian:12) | = 3.2.6-1 | No fix listed |
| debian/sql-ledger(Debian:13) | All versions | No fix listed |
| debian/sql-ledger(Debian:13) | = 3.2.6-1 | No fix listed |
| debian/sql-ledger(Debian:14) | All versions | No fix listed |
| debian/sql-ledger(Debian:14) | = 3.2.6-1 | No fix listed |
References
- 37865 vdb-entry
- 37866 vdb-entry
- 27159 third-party-advisory
- 27171 third-party-advisory
- 3209 third-party-advisory
- www.ledgersmb.org
- 20071009 LedgerSMB < 1.2.8, SQL-Ledger 2.x Multiple SQL Injection Issues mailing-list
- 25979 vdb-entry
- ADV-2007-3453 vdb-entry
- ledgersmb-unspecified-sql-injection(37032) vdb-entry
- sqlledger-unspecified-sql-injection(37033) vdb-entry
- Debian Security Tracker CVE-2007-5372 vendor-advisory
- bugs.debian.org issue-tracking