CVE-2007-6091
Multiple SQL injection vulnerabilities in files/login.asp in JiRo's Banner System (JBS) 2.0, and possibly JiRo's Upload Manager (aka JiRo's Upload System or JUS), allow remote attackers to execute arbitrary SQL commands via the (1) Username (aka Login…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.26%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Multiple SQL injection vulnerabilities in files/login.asp in JiRo's Banner System (JBS) 2.0, and possibly JiRo's Upload Manager (aka JiRo's Upload System or JUS), allow remote attackers to execute arbitrary SQL commands via the (1) Username (aka Login or Email) or (2) Password field.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 2.26% probability · 82th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-89
- Affected
- jiro/banner system
- Source
- cve@mitre.org
References
- http://osvdb.org/38740
- http://osvdb.org/38741
- http://secunia.com/advisories/27713
- http://securityreason.com/securityalert/3384
- http://www.securityfocus.com/archive/1/483859/100/0/threaded
- http://www.securityfocus.com/bid/26479Exploit
- http://osvdb.org/38740
- http://osvdb.org/38741
- http://secunia.com/advisories/27713
- http://securityreason.com/securityalert/3384
- http://www.securityfocus.com/archive/1/483859/100/0/threaded
- http://www.securityfocus.com/bid/26479Exploit
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.