Lucene search

[email protected]CVE-2007-5372

HistoryOct 11, 2007 - 10:17 a.m.

CVE-2007-5372

2007-10-1110:17:00

CWE-89

[email protected]

web.nvd.nist.gov

cve

2007

5372

sql injection

ledgersmb

dws systems

sql-ledger

8.9 High

AI Score

Confidence

Low

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.003 Low

EPSS

Percentile

70.4%

JSON

Multiple SQL injection vulnerabilities in (a) LedgerSMB 1.0.0 through 1.2.7 and (b) DWS Systems SQL-Ledger 2.x allow remote attackers to execute arbitrary SQL commands via (1) the invoice quantity field or (2) the sort field.

CPENameOperatorVersion
dws_systems_inc.:sql-ledgerdws systems inc. sql-ledgereq2.6.14
dws_systems_inc.:sql-ledgerdws systems inc. sql-ledgereq2.4.10
dws_systems_inc.:sql-ledgerdws systems inc. sql-ledgereq2.4.7
ledgersmb:ledgersmbledgersmbeq1.1.0
ledgersmb:ledgersmbledgersmbeq1.2.7
dws_systems_inc.:sql-ledgerdws systems inc. sql-ledgereq2.2.3
dws_systems_inc.:sql-ledgerdws systems inc. sql-ledgereq2.6.12
dws_systems_inc.:sql-ledgerdws systems inc. sql-ledgereq2.2.5
dws_systems_inc.:sql-ledgerdws systems inc. sql-ledgereq2.4.6
dws_systems_inc.:sql-ledgerdws systems inc. sql-ledgereq2.6.15

CPE	Name	Operator	Version
dws_systems_inc.:sql-ledger	dws systems inc. sql-ledger	eq	2.6.14
dws_systems_inc.:sql-ledger	dws systems inc. sql-ledger	eq	2.4.10
dws_systems_inc.:sql-ledger	dws systems inc. sql-ledger	eq	2.4.7
ledgersmb:ledgersmb	ledgersmb	eq	1.1.0
ledgersmb:ledgersmb	ledgersmb	eq	1.2.7
dws_systems_inc.:sql-ledger	dws systems inc. sql-ledger	eq	2.2.3
dws_systems_inc.:sql-ledger	dws systems inc. sql-ledger	eq	2.6.12
dws_systems_inc.:sql-ledger	dws systems inc. sql-ledger	eq	2.2.5
dws_systems_inc.:sql-ledger	dws systems inc. sql-ledger	eq	2.4.6
dws_systems_inc.:sql-ledger	dws systems inc. sql-ledger	eq	2.6.15

Rows per page:

1-10 of 571

References

osvdb.org/37865

osvdb.org/37866

secunia.com/advisories/27159

secunia.com/advisories/27171

securityreason.com/securityalert/3209

www.ledgersmb.org/node/54

www.securityfocus.com/archive/1/481866/100/0/threaded

www.securityfocus.com/bid/25979

www.vupen.com/english/advisories/2007/3453

exchange.xforce.ibmcloud.com/vulnerabilities/37032

exchange.xforce.ibmcloud.com/vulnerabilities/37033

8.9 High

AI Score

Confidence

Low

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.003 Low

EPSS

Percentile

70.4%

JSON

Related for CVE-2007-5372

debiancve1 prion1