Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2007-1979

SQL injection vulnerability in index.php in the PopnupBlog 2.52 and earlier module for Xoops allows remote attackers to execute arbitrary SQL commands via the postid parameter, possibly involving the get_blogid_from_postid function in class/PopnupBlogUtils.php. NOTE: later versions such as 3.03 and 3.05 might also be affected.

Published

2007-04-12T01:19:00.000

Last Modified

2025-04-09T00:30:58.490

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: PARTIAL

Exploitability Score

10.0

Impact Score

6.4

Weaknesses

Type: Primary
NVD-CWE-Other

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	xoops	xoops_popnupblog	≤ 2.52	Yes

References

http://secunia.com/advisories/24761 Vendor Advisory ([email protected])
http://www.securityfocus.com/bid/23286 Exploit ([email protected])
http://www.vupen.com/english/advisories/2007/1206 ([email protected])
https://www.exploit-db.com/exploits/3655 ([email protected])
http://secunia.com/advisories/24761 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/23286 Exploit (af854a3a-2127-422b-91ae-364da2661108)
http://www.vupen.com/english/advisories/2007/1206 (af854a3a-2127-422b-91ae-364da2661108)
https://www.exploit-db.com/exploits/3655 (af854a3a-2127-422b-91ae-364da2661108)