Published: 20/03/2007 Updated: 19/10/2017

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

VMScore: 760

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Multiple SQL injection vulnerabilities in php-stats.recphp.php in PHP-Stats 0.1.9.1b and previous versions allow remote malicious users to execute arbitrary code via a leading dotted-quad IP address string in the (1) PC-REMOTE-ADDR HTTP header, which is inserted into $_SERVER['HTTP_PC_REMOTE_ADDR'], or (2) ip parameter.

Vulnerable Product	Search on Vulmon	Subscribe to Product
php-stats php-stats

<?php print_r(' --------------------------------------------------------------------------- Php-Stats <= 0191b "ip" urldecode()/ ereg() / sql injection / cleat text admin pass disclosure exploit (method ii) by rgod mail: retrog at alice dot it site: retrogodaltervistaorg ------------------------------------------------------------ ...

<?php print_r(' --------------------------------------------------------------------------- Php-Stats <= 0191b PC-REMOTE-ADDR sql injection / cleat text admin pass disclosure by rgod mail: retrog at alice dot it site: retrogodaltervistaorg --------------------------------------------------------------------------- '); if ($argc&l ...

NVD-CWE-Other http://secunia.com/advisories/24553 http://osvdb.org/34280 http://www.vupen.com/english/advisories/2007/1004 https://exchange.xforce.ibmcloud.com/vulnerabilities/33031 https://www.exploit-db.com/exploits/3497 https://www.exploit-db.com/exploits/3496 https://nvd.nist.gov https://www.exploit-db.com/exploits/3497/

CVE-2006-7172

Vulnerability Summary

Exploits

References

Vulmon Search

About

Products

Connect