Published: 02/02/2007 Updated: 16/10/2018

CVSS v2 Base Score: 6.5 | Impact Score: 6.4 | Exploitability Score: 8

VMScore: 578

Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P

The redirect function in Form.pm for (1) LedgerSMB prior to 1.1.5 and (2) SQL-Ledger allows remote authenticated users to execute arbitrary code via redirects, related to callbacks, a different issue than CVE-2006-5872.

Vulnerable Product	Search on Vulmon	Subscribe to Product
sql-ledger sql-ledger 2.4.7
sql-ledger sql-ledger 2.6.19
sql-ledger sql-ledger 2.6.17
sql-ledger sql-ledger 2.6.25
sql-ledger sql-ledger 2.6.18
ledgersmb ledgersmb
sql-ledger sql-ledger 2.6.21

Debian Bug report logs - #409703 SQL-ledger unsafe for use with untrusted users or public installations Package: sql-ledger; Maintainer for sql-ledger is Robert James Clay <jame@rocasaus>; Source for sql-ledger is src:sql-ledger (PTS, buildd, popcon) Reported by: Alex de Oliveira Silva <enerv@hostsk> Date: Sun, 4 ...

NVD-CWE-Other http://www.securityfocus.com/bid/22295 http://securityreason.com/securityalert/2217 http://www.vupen.com/english/advisories/2007/0407 http://www.securityfocus.com/archive/1/459264/100/0/threaded http://www.securityfocus.com/archive/1/458464/100/0/threaded https://nvd.nist.gov https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=409703

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2007-0667

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect