Lucene search

[email protected]CVE-2007-3677

HistoryJul 11, 2007 - 4:30 p.m.

CVE-2007-3677

2007-07-1116:30:00

CWE-89

[email protected]

web.nvd.nist.gov

cve-2007-3677

maxsi evisit analyst

sql injection

remote attackers

arbitrary sql commands

path disclosure

nvd

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

8.5 High

AI Score

Confidence

Low

0.004 Low

EPSS

Percentile

73.3%

JSON

Multiple SQL injection vulnerabilities in Maxsi eVisit Analyst allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) idsp1.pl, (2) ip.pl, and (3) einsite_director.pl. NOTE: this issue can be leveraged for path disclosure from resulting error messages.

Affected configurations

NVD

Node

maxsievisit_analyst

CPENameOperatorVersion
maxsi:evisit_analystmaxsi evisit analysteq*

CPE	Name	Operator	Version
maxsi:evisit_analyst	maxsi evisit analyst	eq	*

References

secunia.com/advisories/26110

www.attrition.org/pipermail/vim/2007-July/001716.html

www.nth-dimension.org.uk/pub/Portcullis-06-057.txt

www.osvdb.org/36112

www.osvdb.org/36113

www.osvdb.org/36114

www.portcullis.co.uk/uplds/advisories/easql%2006-057.txt

www.securityfocus.com/bid/24849

exchange.xforce.ibmcloud.com/vulnerabilities/35481

exchange.xforce.ibmcloud.com/vulnerabilities/35482

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

8.5 High

AI Score

Confidence

Low

0.004 Low

EPSS

Percentile

73.3%

JSON

Related for CVE-2007-3677

prion1 cvelist1 nvd1