National Cyber Awareness System

Vulnerability Summary for CVE-2007-1974

Overview

SQL injection vulnerability in the getArticle function in class/wfsarticle.php in WF-Section (aka WF-Sections) 1.0.1, as used in Xoops modules such as (1) Zmagazine 1.0, (2) Happy Linux XFsection 1.07 and earlier, and possibly other modules, allows remote attackers to execute arbitrary SQL commands via the articleid parameter to print.php.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: http://www.xoops.org/modules/news/article.php?storyid=3717

Type: Advisory; Patch Information

Hyperlink:http://www.xoops.org/modules/news/article.php?storyid=3717

External Source: CONFIRM

Name: http://addons.zarilia.com/index.php?page_type=static&id=43

Type: Patch Information

Hyperlink:http://addons.zarilia.com/index.php?page_type=static&id=43

External Source: XF

Name: xoops-xfsection-print-sql-injection(33380)

Hyperlink:http://xforce.iss.net/xforce/xfdb/33380

External Source: XF

Name: xoops-zmagazine-print-sql-injection(33379)

Hyperlink:http://xforce.iss.net/xforce/xfdb/33379

External Source: XF

Name: xoops-wfsection-print-sql-injection(33378)

Hyperlink:http://xforce.iss.net/xforce/xfdb/33378

External Source: MISC

Name: http://www.xoops.org/modules/newbb/viewtopic.php?viewmode=flat&order=ASC&topic_id=58229&forum=4&move=next&topic_time=1176217411

Type: Advisory

Hyperlink:http://www.xoops.org/modules/newbb/viewtopic.php?viewmode=flat&order=ASC&topic_id=58229&forum=4&move=next&topic_time=1176217411

External Source: VUPEN

Name: ADV-2007-1209

Hyperlink:http://www.vupen.com/english/advisories/2007/1209

External Source: VUPEN

Name: ADV-2007-1208

Hyperlink:http://www.vupen.com/english/advisories/2007/1208

External Source: VUPEN

Name: ADV-2007-1207

Hyperlink:http://www.vupen.com/english/advisories/2007/1207

External Source: BID

Name: 23261

Hyperlink:http://www.securityfocus.com/bid/23261

External Source: BID

Name: 23259

Hyperlink:http://www.securityfocus.com/bid/23259

External Source: BID

Name: 23258

Hyperlink:http://www.securityfocus.com/bid/23258

External Source: MILW0RM

Name: 3646

Hyperlink:http://www.milw0rm.com/exploits/3646

External Source: MILW0RM

Name: 3645

Hyperlink:http://www.milw0rm.com/exploits/3645

External Source: MILW0RM

Name: 3644

Hyperlink:http://www.milw0rm.com/exploits/3644

External Source: VIM

Name: 20070411 WF-Sections SQL injection vendor ack; shows up in other modules

Type: Advisory

Hyperlink:http://www.attrition.org/pipermail/vim/2007-April/001507.html

External Source: OSVDB

Name: 52230

Hyperlink:http://osvdb.org/52230

External Source: OSVDB

Name: 41387

Hyperlink:http://osvdb.org/41387

External Source: BUGTRAQ

Name: 20080218 XOOPS Module section SQL Injection(articleid)

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/488317/100/0/threaded