Lucene search

[email protected]CVE-2007-4112

HistoryJul 31, 2007 - 10:17 a.m.

CVE-2007-4112

2007-07-3110:17:00

NVD-CWE-Other

[email protected]

web.nvd.nist.gov

cve-2007-4112

sql injection

awbs

security vulnerability

xss attacks

nvd

8.6 High

AI Score

Confidence

Low

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.003 Low

EPSS

Percentile

70.1%

JSON

Multiple SQL injection vulnerabilities in Advanced Webhost Billing System (AWBS) before 2.6.0, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via unspecified vectors. NOTE: this can be leveraged for XSS attacks that “bypass AWBS’s anti-XSS input validation.”

CPENameOperatorVersion
advanced_webhost_billing_system:advanced_webhost_billing_systemadvanced webhost billing systemle2.5.1

CPE	Name	Operator	Version
advanced_webhost_billing_system:advanced_webhost_billing_system	advanced webhost billing system	le	2.5.1

References

osvdb.org/37257

secunia.com/advisories/26214

www.justinsamuel.com/2007/06/10/awbs-magic_quotes_gpc-off-sql-injection-and-xss-vulnerabilities/

www.securityfocus.com/bid/25089

exchange.xforce.ibmcloud.com/vulnerabilities/46160

8.6 High

AI Score

Confidence

Low

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.003 Low

EPSS

Percentile

70.1%

JSON

Related for CVE-2007-4112

prion1