CVE - CVE-2007-3814

CVE-ID
CVE-2007-3814	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Multiple SQL injection vulnerabilities in MKPortal 1.1.1 allow remote attackers to execute arbitrary SQL commands via (1) the idurlo field in the delete_urlo function in (a) index.php in the urlobox module; the iden field in the (2) update_file and (3) del_file functions in (b) index.php in the reviews module; the (4) idnews field in the delete_news function and the (5) idcomm field in the del_comment function in (c) index.php in the news module; the (6) idcomm field in the delete_comments function in (d) index.php in the gallery module; the iden field in the (7) edit_file, (8) update_file, and (9) del_file functions in index.php in the gallery module; the (10) ide and (11) cat fields in the slide_update function in index.php in the gallery module; the iden field in the (12) update_file and (13) del_file functions in (d) index.php in the downloads module; and other unspecified vectors.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
BID:24886 URL:http://www.securityfocus.com/bid/24886 BID:24891 URL:http://www.securityfocus.com/bid/24891 BUGTRAQ:20070712 MkPortal - Multiple SQL Injection Vulnerabilities URL:http://www.securityfocus.com/archive/1/473495/100/0/threaded EXPLOIT-DB:4179 URL:https://www.exploit-db.com/exploits/4179 OSVDB:41719 URL:~~http://osvdb.org/41719~~ (Obsolete source) OSVDB:41720 URL:~~http://osvdb.org/41720~~ (Obsolete source) OSVDB:41721 URL:~~http://osvdb.org/41721~~ (Obsolete source) OSVDB:41722 URL:~~http://osvdb.org/41722~~ (Obsolete source) OSVDB:41723 URL:~~http://osvdb.org/41723~~ (Obsolete source) SREASON:2894 URL:http://securityreason.com/securityalert/2894 XF:mkportal-multiple-sql-injection(35391) URL:https://exchange.xforce.ibmcloud.com/vulnerabilities/35391
Assigning CNA
MITRE Corporation
Date Record Created
20070716	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20070716)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)