CVE-2006-4757: Multiple SQL injection vulnerabilities in the admin section in e107 0.7.5 allow remote authenticated administrative users to execute arbitrary SQL commands via the (1)…

Unscored severity · published Sep 13, 2006

CVE-2006-4757

Multiple SQL injection vulnerabilities in the admin section in e107 0.7.5 allow remote authenticated administrative users to execute arbitrary SQL commands via the (1)…

–

CVSS

0.9%

EPSS

On KEV

Description

Multiple SQL injection vulnerabilities in the admin section in e107 0.7.5 allow remote authenticated administrative users to execute arbitrary SQL commands via the (1) linkopentype, (2) linkrender, (3) link_class, and (4) link_id parameters in (a) links.php; the (5) searchquery parameter in (b) users.php; and the (6) download_category_class parameter in (c) download.php. NOTE: an e107 developer has disputed the significance of the vulnerability, stating that "If your admins are injecting you, you might want to reconsider their access."

Exploitation

Is it being used?

Exploit prediction (EPSS)0.9% · higher than 60% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

E107 · E107

through 0.7.5; 0.6_10; 0.6_11; 0.6_12; 0.6_13; 0.6_14; +34 more · source: NVD

Affected product

E107