CVE-2007-4804: SQL Injection

Published Sep 11, 2007

Updated

Multiple SQL injection vulnerabilities in AuraCMS 1.5rc allow remote attackers to execute arbitrary SQL commands via the id parameter in (1) hal.php, (2) cetak.php, (3) lihat.php, (4) pesan.php, and (5) teman.php, different vectors than CVE-2007-4171. NOTE: the scripts may be accessed through requests to the product's top-level default URI, using the pilih parameter, in some circumstances.

Affected Software

1 affected component

AuraCMS AuraCMS=1.5_rc

Event History

Sep 11, 2007

CVE Published

06:17 PM

CVE Published

via MITRE·10:00 PM

Data Sourced

via MITRE·10:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2007-4804?

CVE-2007-4804 is considered a medium severity vulnerability due to its potential for SQL injection attacks.

How do I fix CVE-2007-4804?

To fix CVE-2007-4804, you should sanitize and validate all user inputs, particularly the id parameter in the affected scripts.

Which versions of AuraCMS are affected by CVE-2007-4804?

AuraCMS versions 1.5rc are affected by CVE-2007-4804.

What types of attacks can CVE-2007-4804 facilitate?

CVE-2007-4804 can facilitate SQL injection attacks, allowing remote attackers to execute arbitrary SQL commands.

In which scripts can CVE-2007-4804 be exploited?

CVE-2007-4804 can be exploited through the hal.php, cetak.php, lihat.php, pesan.php, and teman.php scripts.