Lumension® Endpoint Intelligence Center

Intelligence Center » Browse All Vulnerabilities » CVE-2007-4808

Overview

Vulnerability Score 7.5 7.5
CVE Id CVE-2007-4808
Last Modified 06 Sep 2011 12:00:00
Published 11 Sep 2007 02:17:00
Confidentiality Impact PARTIAL PARTIAL
Integrity Impact PARTIAL PARTIAL
Availability Impact PARTIAL PARTIAL
Access Vector NETWORK
Access Complexity LOW
Authentication NONE

CVE-2007-4808

Summary

Multiple SQL injection vulnerabilities in TLM CMS 3.2 allow remote attackers to execute arbitrary SQL commands via (1) the id parameter to news.php in a lirenews action, (2) the idnews parameter to goodies.php in a lire action, (3) the id parameter to file.php in a voir action, (4) the ID parameter to affichage.php, (5) the id_sal parameter to mod_forum/afficher.php, or (6) the id_sujet parameter to mod_forum/messages.php. NOTE: it was later reported that goodies.php and affichage.php scripts are reachable through index.php, and 1.1 is also affected. NOTE: it was later reported that the goodies.php vector also affects 3.1.

Vulnerable Systems

Application

  • Tlm Cms 1.1

  • Tlm Cms 3.2


References

XF - tlm-index-sql-injection(42204)

XF - tlmcms-multiple-sql-injection(36536)

MISC - http://www.z0rlu.ownspace.org/index.php?/archives/74-Powered-by-TLM-CMS-index.php-sql-inj..html

VUPEN - ADV-2007-3137

BID - 29049

BID - 25602

MILW0RM - 4376

SECUNIA - 26752

OSVDB - 37006

OSVDB - 37005

OSVDB - 37004

OSVDB - 37003

OSVDB - 37002

OSVDB - 37001


Last Updated: 27 May 2016 10:45:58