CVE-2007-1974: SQL Injection
SQL injection vulnerability in the getArticle function in class/wfsarticle.php in WF-Section (aka WF-Sections) 1.0.1, as used in Xoops modules such as (1) Zmagazine 1.0, (2) Happy Linux XFsection 1.07 and earlier, and possibly other modules, allows remote attackers to execute arbitrary SQL commands via the articleid parameter to print.php.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2007-1974?
CVE-2007-1974 has a high severity rating due to its potential for remote SQL injection attacks.
How do I fix CVE-2007-1974?
To fix CVE-2007-1974, upgrade to a version of WF-Sections that is not affected, such as versions later than 1.0.1.
What applications are affected by CVE-2007-1974?
CVE-2007-1974 affects WF-Section 1.0.1 and specific Xoops modules like Zmagazine 1.0 and Happy Linux XFsection 1.07 and earlier.
Can CVE-2007-1974 lead to data loss?
Yes, CVE-2007-1974 can allow remote attackers to execute arbitrary SQL commands, potentially leading to data loss.
Is CVE-2007-1974 a common vulnerability?
CVE-2007-1974 is a notable vulnerability primarily found in legacy Xoops modules, making it less common but still critical to address.