Unscored severity · published Sep 18, 2007
CVE-2007-4956
Multiple SQL injection vulnerabilities in KwsPHP 1.0 allow remote attackers to execute arbitrary SQL commands via (1) the pseudo parameter to login.php, (2) the id parameter to…
–
CVSS
3.5%
EPSS
No
On KEV
Description
Multiple SQL injection vulnerabilities in KwsPHP 1.0 allow remote attackers to execute arbitrary SQL commands via (1) the pseudo parameter to login.php, (2) the id parameter to index.php in a carnet editer action in the Member_Space (espace_membre) module, or (3) the typenav parameter to index.php in a browser aff action in the stats module.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.5% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KW
Kwsphp · Kwsphp
1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-4956
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-4956
koogar.alorys-hebergement.com
http://koogar.alorys-hebergement.com/kwsphp/index.php?mod=news&ac=commentaires&id=29
osvdb.org
http://osvdb.org/37180
osvdb.org
http://osvdb.org/37182
secunia.com
http://secunia.com/advisories/26850
www.securityfocus.com
http://www.securityfocus.com/bid/25679
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/36634
More from Kwsphp
–
CVE-2008-6201
Directory traversal vulnerability in help.php in the eskuel module in KwsPHP 1.3.456, as available before 20080416, allows remote attackers to execute arbitrary commands via the…
–
CVE-2008-1757
Cross-site scripting (XSS) vulnerability in index.php in the ConcoursPhoto module for KwsPHP 1.0 allows remote attackers to inject arbitrary web script or HTML via the VIEW…
–
CVE-2008-1758
SQL injection vulnerability in the ConcoursPhoto module for KwsPHP allows remote attackers to execute arbitrary SQL commands via the C_ID parameter to index.php
–
CVE-2008-1759
SQL injection vulnerability in the jeuxflash module for KwsPHP allows remote attackers to execute arbitrary SQL commands via the cat parameter to index.php, a different vector…
–
CVE-2007-5485
SQL injection vulnerability in index.php in the mg2 1.0 module for KwsPHP allows remote attackers to execute arbitrary SQL commands via the album parameter