PT-2007-2361 · Philboard · Philboard

Mehmet Ince

+1

·

CVE-2007-0920

·

Published

2007-02-14

·

Updated

2017-10-19

CVSS v2.0

7.5

High

VectorAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions: Philboard versions 1.14 and earlier
Description: The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the forumid parameter in the "philboard forum.asp" file.
Recommendations: For Philboard versions 1.14 and earlier, consider restricting access to the forumid parameter in the philboard forum.asp file until a patch is available. Avoid using the forumid parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Related Identifiers

CVE-2007-0920

Affected Products

Philboard