Vulnerabilities > CVE-2007-1019 - SQL Injection vulnerability in Webspell 4.01.02

047910
CVSS 6.8 - MEDIUM
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
webspell
exploit available

Summary

SQL injection vulnerability in news.php in webSPELL 4.01.02, when register_globals is enabled, allows remote attackers to execute arbitrary SQL commands via the showonly parameter to index.php, a different vector than CVE-2006-5388. Successful exploitation e.g. allows retrieval of password hashes, but requires that "register_globals" is enabled.

Vulnerable Configurations

Part Description Count
Application
Webspell
1

Exploit-Db

descriptionwebSPELL 4.01.02 (showonly) Remote Blind SQL Injection Exploit. CVE-2007-1019. Webapps exploit for php platform
fileexploits/php/webapps/3325.pl
idEDB-ID:3325
last seen2016-01-31
modified2007-02-16
platformphp
port
published2007-02-16
reporterDNX
sourcehttps://www.exploit-db.com/download/3325/
titlewebSPELL 4.01.02 showonly Remote Blind SQL Injection Exploit
typewebapps