CVE-2006-4757
Multiple SQL injection vulnerabilities in the admin section in e107 0.7.5 allow remote authenticated administrative users to execute arbitrary SQL commands via the (1) linkopentype, (2) linkrender, (3) link_class, and (4) link_id parameters in (a)…
Does this matter?
Lower severity and a low EPSS score (0.90%). Track it; it rarely justifies an emergency change on its own.
Description
Multiple SQL injection vulnerabilities in the admin section in e107 0.7.5 allow remote authenticated administrative users to execute arbitrary SQL commands via the (1) linkopentype, (2) linkrender, (3) link_class, and (4) link_id parameters in (a) links.php; the (5) searchquery parameter in (b) users.php; and the (6) download_category_class parameter in (c) download.php. NOTE: an e107 developer has disputed the significance of the vulnerability, stating that "If your admins are injecting you, you might want to reconsider their access."
- CVSS 2.0
- 4.6 MEDIUMAV:N/AC:H/Au:S/C:P/I:P/A:P
- EPSS
- 0.90% probability · 58th percentile
- CISA KEV
- Not listed
- Affected
- e107/e107
- Source
- cve@mitre.org
References
- http://e107.org/e107_plugins/bugtrack/bugtrack.php?id=3195&action=show
- http://securityreason.com/securityalert/1569
- http://www.securityfocus.com/archive/1/445005/100/100/threaded
- http://e107.org/e107_plugins/bugtrack/bugtrack.php?id=3195&action=show
- http://securityreason.com/securityalert/1569
- http://www.securityfocus.com/archive/1/445005/100/100/threaded
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.