CVE-2007-2684: SQL Injection
Jetbox CMS 2.1 allows remote attackers to obtain sensitive information via (1) a direct request to (a) mainpage.php, (b) opentree.php, and (c) outputs.php; (2) a malformed view parameter to index.php, as demonstrated with an SQL injection manipulation; or (3) the id[] parameter to admin/cms/opentree.php, which reveals the installation path in the resulting error message.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2007-2684?
CVE-2007-2684 is classified as a medium severity vulnerability due to its potential for sensitive information disclosure.
How can CVE-2007-2684 be exploited?
CVE-2007-2684 can be exploited by remote attackers through direct requests to specific PHP files or by manipulating parameters leading to SQL injection.
What systems are affected by CVE-2007-2684?
CVE-2007-2684 specifically affects Jetbox CMS version 2.1.
How do I fix CVE-2007-2684?
To fix CVE-2007-2684, it is recommended to upgrade Jetbox CMS to a version that has addressed these vulnerabilities.
What kind of information can be leaked through CVE-2007-2684?
CVE-2007-2684 can lead to the disclosure of sensitive information stored in the database of the affected system.