Unscored severity · published Apr 12, 2007
CVE-2007-1974
SQL injection vulnerability in the getArticle function in class/wfsarticle.php in WF-Section (aka WF-Sections) 1.0.1, as used in Xoops modules such as (1) Zmagazine 1.0, (2) Happy…
–
CVSS
5.5%
EPSS
No
On KEV
Description
SQL injection vulnerability in the getArticle function in class/wfsarticle.php in WF-Section (aka WF-Sections) 1.0.1, as used in Xoops modules such as (1) Zmagazine 1.0, (2) Happy Linux XFsection 1.07 and earlier, and possibly other modules, allows remote attackers to execute arbitrary SQL commands via the articleid parameter to print.php.
Exploitation
Is it being used?
Exploit prediction (EPSS)5.5% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HL
Happy Linux Xfsection Module · Xoops
through 1.07 · source: NVD
WF
Wf-sections · Wf-sections
1.0.1 · source: NVD
ZM
Zmagazine Module · Xoops
1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-1974
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-1974
Patch
http://addons.zarilia.com/index.php?page_type=static&id=43
osvdb.org
http://osvdb.org/41387
osvdb.org
http://osvdb.org/52230
Vendor Advisory
http://www.attrition.org/pipermail/vim/2007-April/001507.html
www.securityfocus.com
http://www.securityfocus.com/archive/1/488317/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/23258
More from Wf-sections
–
CVE-2005-0725
SQL injection vulnerability in the getAllbyArticle function in wfsfiles.php for WF-Sections (wfsections) 1.07 allows remote attackers to execute arbitrary SQL commands via the…