CVE-2007-6566

SQL injection vulnerability in post.php in XZero Community Classifieds 4.95.11 and earlier allows remote attackers to execute arbitrary SQL commands via the subcatid parameter to index.php.

Score

CVSS 2.0 7.5 High

Status

Modified - cve@mitre.org

Published

2007-12-28

Last modified

2024-08-07

Weaknesses

CWE-89

Affected products

• Xzero Community Classifieds (Xzero Scripts)

References

• http://en.rstzone.org/xzero-community-classifieds-v4-95-11-lfi-sql-in-t9394.rst
• http://osvdb.org/39740
• http://secunia.com/advisories/28250
• http://www.securityfocus.com/archive/1/485545/100/0/threaded
• http://www.securityfocus.com/bid/27042
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39259
• https://www.exploit-db.com/exploits/4794