Login Request a demo
Unscored severity · published Jan 31, 2007
CVE-2007-0623
SQL injection vulnerability in index.php in MAXdev MDPro 1.0.76 allows remote attackers to execute arbitrary SQL commands via the startrow parameter
–
CVSS
1.8%
EPSS
No
On KEV
Description
SQL injection vulnerability in index.php in MAXdev MDPro 1.0.76 allows remote attackers to execute arbitrary SQL commands via the startrow parameter.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 79% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MD
Mdpro · Maxdev
1.0.76 · source: NVD
Affected product
MD
Mdpro
Maxdev
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-0623
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-0623
osvdb.org
http://osvdb.org/33011
osvdb.org
http://osvdb.org/33612
Vendor Advisory
http://secunia.com/advisories/23948
securityreason.com
http://securityreason.com/securityalert/2198
www.securityfocus.com
http://www.securityfocus.com/archive/1/458438/100/0/threaded
Exploit
http://www.securityfocus.com/bid/22293
More from Mdpro
–
CVE-2009-2618
SQL injection vulnerability in the Surveys (aka NS-Polls) module in MDPro (MD-Pro) 1.083.x allows remote attackers to execute arbitrary SQL commands via the pollID parameter in a…
–
CVE-2007-5222
SQL injection vulnerability in index.php in MAXdev MDPro (MD-Pro) 1.0.76 allows remote attackers to execute arbitrary SQL commands via a "Firefox ID=" substring in a Referer HTTP…
–
CVE-2007-3938
SQL injection vulnerability in index.php in MAXdev MDPro (MD-Pro) 1.0.8x and earlier before 20070720 allows remote attackers to execute arbitrary SQL commands via the topicid…
–
CVE-2006-7112
Directory traversal vulnerability in error.php in MD-Pro 1.0.76 and earlier allows remote authenticated users to read and include arbitrary files via the PNSVlang cookie, as…
–
CVE-2007-0624
user.php in MAXdev MDPro 1.0.76 allows remote attackers to obtain the full path via a ' (quote) character, and possibly other invalid values, in the uname parameter in a userinfo…