Design/Logic Flaw

The redirect function in Form.pm for 1 LedgerSMB before 1.1.5 and 2 SQL-Ledger allows remote authenticated users to execute arbitrary code via redirects, related to callbacks, a different issue than CVE-2006-5872...

CVE-2007-0667

The redirect function in Form.pm for 1 LedgerSMB before 1.1.5 and 2 SQL-Ledger allows remote authenticated users to execute arbitrary code via redirects, related to callbacks, a different issue than CVE-2006-5872...

CVE-2007-0667

The redirect function in Form.pm for 1 LedgerSMB before 1.1.5 and 2 SQL-Ledger allows remote authenticated users to execute arbitrary code via redirects, related to callbacks, a different issue than CVE-2006-5872...

UBUNTU-CVE-2007-0667

The redirect function in Form.pm for 1 LedgerSMB before 1.1.5 and 2 SQL-Ledger allows remote authenticated users to execute arbitrary code via redirects, related to callbacks, a different issue than CVE-2006-5872...

CVE-2007-0667

The redirect function in Form.pm for 1 LedgerSMB before 1.1.5 and 2 SQL-Ledger allows remote authenticated users to execute arbitrary code via redirects, related to callbacks, a different issue than CVE-2006-5872...

CVE-2007-0667

The CVE-2007-0667 entry: The redirect function in Form.pm affects LedgerSMB

Arbitrary Code Execution in SQL-Ledger and LedgerSMB through redirects

Separate from CVE-2006-5872, there is a possibility of causing arbitrary code execution during redirects. This requires a valid login to exploit and was discovered and brought to the attention of both the SQL-Ledger and LedgerSMB team in November. LedgerSMB 1.1.5 corred the problem, but it is sti...

LedgerSMB / SQL-Ledger login.pl script Parameter Arbitrary Perl Code Execution

The remote host is running LedgerSMB or SQL-Ledger, a web-based, double-entry accounting system. The version of LedgerSMB or SQL-Ledger on the remote host fails to sanitize user-supplied input to the 'script' parameter of the 'login.pl' script before using it to execute Perl code. An...

Full Disclosure: Arbitrary Code Execution in LedgerSMB CVE-2006-5872

CVE-2006-5872 filed against SQL-Ledger also affects LedgerSMB. This was first fixed in LedgerSMB 1.1.5 but due to a number of unrelated bugs, we recommend upgrading to 1.1.7. SQL-Ledger fixed the problem in 2.6.21. This occurs due to the improper handling of input handling in the redirect functio...

CVE-2006-5872

login.pl in SQL-Ledger before 2.6.21 and LedgerSMB before 1.1.5 allows remote attackers to execute arbitrary Perl code via the "-e" flag in the script parameter, which is used as an argument to the perl program...

DEBIAN-CVE-2006-5872

login.pl in SQL-Ledger before 2.6.21 and LedgerSMB before 1.1.5 allows remote attackers to execute arbitrary Perl code via the "-e" flag in the script parameter, which is used as an argument to the perl program...

CVE-2006-5872

login.pl in SQL-Ledger before 2.6.21 and LedgerSMB before 1.1.5 allows remote attackers to execute arbitrary Perl code via the "-e" flag in the script parameter, which is used as an argument to the perl program...

CVE-2006-5872

SQL-Ledger before 2.6.21 and LedgerSMB before 1.1.5 are affected by an input sanitising vulnerability that allows remote attackers to execute arbitrary Perl code via the -e flag in the script parameter. This mirrors the CVE-2006-5872 issue described in the Debian advisory (DSA-1239-1) and OpenVAS...

CVE-2006-5872

login.pl in SQL-Ledger before 2.6.21 and LedgerSMB before 1.1.5 allows remote attackers to execute arbitrary Perl code via the "-e" flag in the script parameter, which is used as an argument to the perl program...

CVE-2006-5872

login.pl in SQL-Ledger before 2.6.21 and LedgerSMB before 1.1.5 allows remote attackers to execute arbitrary Perl code via the "-e" flag in the script parameter, which is used as an argument to the perl program...

CVE-2006-5589

Multiple SQL injection vulnerabilities in LedgerSMB LSMB 1.1.0 and earlier allow remote attackers to execute arbitrary SQL commands via unspecified vectors in 1 OE.pm, 2 AM.pm, and 3 Form.pm...

CVE-2006-5589

Summary: CVE-2006-5589 affects LedgerSMB (LSMB) up to 1.1.0 and earlier with SQL injection vulnerabilities in the modules OE.pm, AM.pm, and Form.pm that allow remote execution of arbitrary SQL commands. The risk is described as high (CVSS v2 base score 7.5). Connected documents confirm that Ledge...

CVE-2006-5589

Multiple SQL injection vulnerabilities in LedgerSMB LSMB 1.1.0 and earlier allow remote attackers to execute arbitrary SQL commands via unspecified vectors in 1 OE.pm, 2 AM.pm, and 3 Form.pm...

CVE-2006-4731

Multiple directory traversal vulnerabilities in 1 login.pl and 2 admin.pl in a SQL-Ledger before 2.6.19 and b LedgerSMB before 1.0.0p1 allow remote attackers to execute arbitrary Perl code via an unspecified terminal parameter value containing ../ dot dot slash...

CVE-2006-4731

Multiple directory traversal vulnerabilities in 1 login.pl and 2 admin.pl in a SQL-Ledger before 2.6.19 and b LedgerSMB before 1.0.0p1 allow remote attackers to execute arbitrary Perl code via an unspecified terminal parameter value containing ../ dot dot slash...