Lucene search

[email protected]CVE-2007-3677

HistoryJul 11, 2007 - 4:30 p.m.

CVE-2007-3677

2007-07-1116:30:00

CWE-89

[email protected]

web.nvd.nist.gov

cve-2007-3677

maxsi evisit analyst

sql injection

remote attackers

arbitrary sql commands

path disclosure

nvd

9.4 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.004 Low

EPSS

Percentile

74.3%

JSON

Multiple SQL injection vulnerabilities in Maxsi eVisit Analyst allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) idsp1.pl, (2) ip.pl, and (3) einsite_director.pl. NOTE: this issue can be leveraged for path disclosure from resulting error messages.

CPENameOperatorVersion
maxsi:evisit_analystmaxsi evisit analysteq*

CPE	Name	Operator	Version
maxsi:evisit_analyst	maxsi evisit analyst	eq	*

References

secunia.com/advisories/26110

www.attrition.org/pipermail/vim/2007-July/001716.html

www.nth-dimension.org.uk/pub/Portcullis-06-057.txt

www.osvdb.org/36112

www.osvdb.org/36113

www.osvdb.org/36114

www.portcullis.co.uk/uplds/advisories/easql%2006-057.txt

www.securityfocus.com/bid/24849

exchange.xforce.ibmcloud.com/vulnerabilities/35481

exchange.xforce.ibmcloud.com/vulnerabilities/35482

9.4 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.004 Low

EPSS

Percentile

74.3%

JSON

Related for CVE-2007-3677

prion1