Lucene search

[email protected]CVE-2007-5646

HistoryOct 23, 2007 - 9:47 p.m.

CVE-2007-5646

2007-10-2321:47:00

CWE-89

[email protected]

web.nvd.nist.gov

cve-2007-5646

sql injection

smf

security vulnerability

nvd

mysql 5

8.7 High

AI Score

Confidence

Low

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.007 Low

EPSS

Percentile

80.1%

JSON

SQL injection vulnerability in Sources/Search.php in Simple Machines Forum (SMF) 1.1.3, when MySQL 5 is used, allows remote attackers to execute arbitrary SQL commands via the userspec parameter in a search2 action to index.php.

CPENameOperatorVersion
simple_machines:simple_machines_forumsimple machines simple machines forumeq1.0.11
simple_machines:simple_machines_forumsimple machines simple machines forumeq1.1.3

CPE	Name	Operator	Version
simple_machines:simple_machines_forum	simple machines simple machines forum	eq	1.0.11
simple_machines:simple_machines_forum	simple machines simple machines forum	eq	1.1.3

References

secunia.com/advisories/27346

securityreason.com/securityalert/3284

www.securityfocus.com/archive/1/482569/100/0/threaded

www.securityfocus.com/bid/26144

www.simplemachines.org/community/index.php?topic=196380.0

www.vupen.com/english/advisories/2007/3568

exchange.xforce.ibmcloud.com/vulnerabilities/37342

www.exploit-db.com/exploits/4547

8.7 High

AI Score

Confidence

Low

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.007 Low

EPSS

Percentile

80.1%

JSON

Related for CVE-2007-5646

nessus1 prion1 cvelist1