CVE

Id
28165  
CVE No.
CVE-2007-4808  
Status
Candidate  
Description
Multiple SQL injection vulnerabilities in TLM CMS 3.2 allow remote attackers to execute arbitrary SQL commands via (1) the id parameter to news.php in a lirenews action, (2) the idnews parameter to goodies.php in a lire action, (3) the id parameter to file.php in a voir action, (4) the ID parameter to affichage.php, (5) the id_sal parameter to mod_forum/afficher.php, or (6) the id_sujet parameter to mod_forum/messages.php. NOTE: it was later reported that goodies.php and affichage.php scripts are reachable through index.php, and 1.1 is also affected. NOTE: it was later reported that the goodies.php vector also affects 3.1.  
Phase
Assigned (20070911)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
292210 28165 CVE-2007-4808 MILW0RM:4376  View
292211 28165 CVE-2007-4808 URL:http://www.milw0rm.com/exploits/4376  View
292212 28165 CVE-2007-4808 MISC:http://www.z0rlu.ownspace.org/index.php?/archives/74-Powered-by-TLM-CMS-index.php-sql-inj..html  View
292213 28165 CVE-2007-4808 BID:25602  View
292214 28165 CVE-2007-4808 URL:http://www.securityfocus.com/bid/25602  View
292215 28165 CVE-2007-4808 BID:29049  View
292216 28165 CVE-2007-4808 URL:http://www.securityfocus.com/bid/29049  View
292217 28165 CVE-2007-4808 VUPEN:ADV-2007-3137  View
292218 28165 CVE-2007-4808 URL:http://www.vupen.com/english/advisories/2007/3137  View
292219 28165 CVE-2007-4808 OSVDB:37001  View
292220 28165 CVE-2007-4808 URL:http://osvdb.org/37001  View
292221 28165 CVE-2007-4808 OSVDB:37002  View
292222 28165 CVE-2007-4808 URL:http://osvdb.org/37002  View
292223 28165 CVE-2007-4808 OSVDB:37003  View
292224 28165 CVE-2007-4808 URL:http://osvdb.org/37003  View
292225 28165 CVE-2007-4808 OSVDB:37004  View
292226 28165 CVE-2007-4808 URL:http://osvdb.org/37004  View
292227 28165 CVE-2007-4808 OSVDB:37005  View
292228 28165 CVE-2007-4808 URL:http://osvdb.org/37005  View
292229 28165 CVE-2007-4808 OSVDB:37006  View
292230 28165 CVE-2007-4808 URL:http://osvdb.org/37006  View
292231 28165 CVE-2007-4808 SECUNIA:26752  View
292232 28165 CVE-2007-4808 URL:http://secunia.com/advisories/26752  View
292233 28165 CVE-2007-4808 XF:tlmcms-multiple-sql-injection(36536)  View
292234 28165 CVE-2007-4808 URL:http://xforce.iss.net/xforce/xfdb/36536  View
292235 28165 CVE-2007-4808 XF:tlm-index-sql-injection(42204)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
55677 JVNDB-2007-004369 Netjuke における SQL インジェクションの脆弱性 Netjuke には、SQL インジェクションの脆弱性が存在します。 CVE-2007-4810 28165 7.5 http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-004369.html  View