PRIOn knowledge basePRION:CVE-2007-1548

HistoryMar 20, 2007 - 10:19 p.m.

Sql injection

2007-03-2022:19:00

PRIOn knowledge base

www.prio-n.com

9 High

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

71.0%

JSON

SQL injection vulnerability in functions/functions_filters.asp in Web Wiz Forums before 8.05a (MySQL version) does not properly filter certain characters in SQL commands, which allows remote attackers to execute arbitrary SQL commands via "’ (backslash double-quote quote) sequences, which are collapsed into '', as demonstrated via the name parameter to forum/pop_up_member_search.asp.

CPENameOperatorVersion
web_wiz_forumseq7.95
web_wiz_forumseq6 beta-2
web_wiz_forumseq7.92
web_wiz_forumseq6.34
web_wiz_forumseq6.21
web_wiz_forumseq6.32
web_wiz_forumseq6.27
web_wiz_forumseq8.03
web_wiz_forumseq8.04
web_wiz_forumseq7 rc1

Name	Operator	Version
web_wiz_forums	eq	7.95
web_wiz_forums	eq	6 beta-2
web_wiz_forums	eq	7.92
web_wiz_forums	eq	6.34
web_wiz_forums	eq	6.21
web_wiz_forums	eq	6.32
web_wiz_forums	eq	6.27
web_wiz_forums	eq	8.03
web_wiz_forums	eq	8.04
web_wiz_forums	eq	7 rc1

Rows per page:

1-10 of 521

References

osvdb.org/34344

secunia.com/advisories/24561

securityreason.com/securityalert/2456

www.securityfocus.com/archive/1/463287/100/0/threaded

www.securityfocus.com/bid/23051

www.vupen.com/english/advisories/2007/1061

www.webwizguide.info/web_wiz_forums/Version%20History.txt

exchange.xforce.ibmcloud.com/vulnerabilities/33095

ifsec.blogspot.com/2007/03/web-wiz-forums-805-mysql-version-sql.html