CVE-2011-4921

SQL injection vulnerability in usersettings.php in e107 0.7.26, and possibly other versions before 1.0.0, allows remote attackers to execute arbitrary SQL commands via the username parameter.

CVSS v2.0 5.1 MEDIUM

5.1^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:H/Au:N/C:P/I:P/A:P

Exploitability : 4.9 / Impact : 6.4

Access Vector NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://osvdb.org/78050
http://secunia.com/advisories/46706	Vendor Advisory
http://www.openwall.com/lists/oss-security/2012/01/04/3
http://www.securityfocus.com/bid/51253
https://exchange.xforce.ibmcloud.com/vulnerabilities/72011
http://osvdb.org/78050
http://secunia.com/advisories/46706	Vendor Advisory
http://www.openwall.com/lists/oss-security/2012/01/04/3
http://www.securityfocus.com/bid/51253
https://exchange.xforce.ibmcloud.com/vulnerabilities/72011

Configurations

Configuration 1 (hide)

cpe:2.3:a:e107:e107:0.7.26:*:*:*:*:*:*:*

History

21 Nov 2024, 01:33

Type	Values Removed	Values Added
References	~~() http://osvdb.org/78050 -~~	() http://osvdb.org/78050 -
References	~~() http://secunia.com/advisories/46706 - Vendor Advisory~~	() http://secunia.com/advisories/46706 - Vendor Advisory
References	~~() http://www.openwall.com/lists/oss-security/2012/01/04/3 -~~	() http://www.openwall.com/lists/oss-security/2012/01/04/3 -
References	~~() http://www.securityfocus.com/bid/51253 -~~	() http://www.securityfocus.com/bid/51253 -
References	~~() https://exchange.xforce.ibmcloud.com/vulnerabilities/72011 -~~	() https://exchange.xforce.ibmcloud.com/vulnerabilities/72011 -

Information

Published : 2012-01-04 19:55

Updated : 2024-11-21 01:33

NVD link : CVE-2011-4921

Mitre link : CVE-2011-4921

CVE.ORG link : CVE-2011-4921

JSON object : View

Products Affected

e107

e107

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2011-4921", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.1, "accessVector": "NETWORK", "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "HIGH", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 4.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2012-01-04T19:55:02.193", "references": [{"url": "http://osvdb.org/78050", "source": "secalert@redhat.com"}, {"url": "http://secunia.com/advisories/46706", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://www.openwall.com/lists/oss-security/2012/01/04/3", "source": "secalert@redhat.com"}, {"url": "http://www.securityfocus.com/bid/51253", "source": "secalert@redhat.com"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/72011", "source": "secalert@redhat.com"}, {"url": "http://osvdb.org/78050", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://secunia.com/advisories/46706", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.openwall.com/lists/oss-security/2012/01/04/3", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/51253", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/72011", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "SQL injection vulnerability in usersettings.php in e107 0.7.26, and possibly other versions before 1.0.0, allows remote attackers to execute arbitrary SQL commands via the username parameter."}, {"lang": "es", "value": "Vulnerabilida de inyecci\u00f3n SQL en usersettings.php en e107 v0.7.26 y posiblemente otras versiones anteriores a 1.0.0, permite a atacantes remotos ejecutar comandos SQL de su elecci\u00f3n a trav\u00e9s del par\u00e1metro username."}], "lastModified": "2024-11-21T01:33:18.237", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:e107:e107:0.7.26:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4C218B8E-ED52-4F5B-A3FC-CEB3FF8D11DD"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}