CVE-2007-1292: SQL Injection

Q: What is the severity of CVE-2007-1292?

CVE-2007-1292 is classified as a moderate severity vulnerability that can allow remote authenticated users to execute arbitrary SQL commands.

Q: How do I fix CVE-2007-1292?

To fix CVE-2007-1292, you should upgrade your vBulletin installation to version 3.5.8 or later.

Q: Which versions are affected by CVE-2007-1292?

CVE-2007-1292 affects all vBulletin versions prior to 3.5.8 and 3.6.5 for the 3.6.x series.

Q: Is CVE-2007-1292 exploitable remotely?

Yes, CVE-2007-1292 can be exploited by remote authenticated users.

Q: What type of vulnerability is CVE-2007-1292?

CVE-2007-1292 is an SQL injection vulnerability.

Published Mar 7, 2007

Updated

SQL injection vulnerability in inlinemod.php in Jelsoft vBulletin before 3.5.8, and before 3.6.5 in the 3.6.x series, might allow remote authenticated users to execute arbitrary SQL commands via the postids parameter. NOTE: the vendor states that the attack is feasible only in circumstances "almost impossible to achieve."

Affected Software

7 affected components

Jelsoft vBulletin=3.6.2

Jelsoft vBulletin=3.6.1

Jelsoft vBulletin=3.6.4

Jelsoft vBulletin=3.6.5

Jelsoft vBulletin<=3.5.8

Jelsoft vBulletin=3.6.0

Jelsoft vBulletin=3.6.3

Remediation

Patch Available

http://www.vbulletin.com/forum/showthread.php?postid=1314422

Event History

Mar 7, 2007

CVE Published

12:19 AM

CVE Published

via MITRE·05:00 AM

Data Sourced

via MITRE·05:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2007-1292?

CVE-2007-1292 is classified as a moderate severity vulnerability that can allow remote authenticated users to execute arbitrary SQL commands.

How do I fix CVE-2007-1292?

To fix CVE-2007-1292, you should upgrade your vBulletin installation to version 3.5.8 or later.

Which versions are affected by CVE-2007-1292?