CVE-2007-1019: SQL Injection

Published Feb 21, 2007

Updated

SQL injection vulnerability in news.php in webSPELL 4.01.02, when registerglobals is enabled, allows remote attackers to execute arbitrary SQL commands via the showonly parameter to index.php, a different vector than CVE-2006-5388.

Affected Software

1 affected component

webSPELL Webspell=4.01.02

Event History

Feb 21, 2007

CVE Published

11:28 AM

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2007-1019?

CVE-2007-1019 is considered a medium severity vulnerability due to its potential for SQL injection attacks.

How do I fix CVE-2007-1019?

To fix CVE-2007-1019, disable register_globals in your PHP configuration and update to a patched version of webSPELL if available.

What does CVE-2007-1019 allow attackers to do?

CVE-2007-1019 allows remote attackers to execute arbitrary SQL commands through the showonly parameter in index.php.

Which software versions are affected by CVE-2007-1019?

CVE-2007-1019 specifically affects webSPELL version 4.01.02 when register_globals is enabled.

Is CVE-2007-1019 related to any other vulnerabilities?

Yes, CVE-2007-1019 is a different vector than CVE-2006-5388, which also involves SQL injection in webSPELL.