CVE-2007-0971 - Vulnerability Details - OpenCVE

Multiple SQL injection vulnerabilities in Jupiter CMS 1.1.5 allow remote attackers to execute arbitrary SQL commands via the Client-IP HTTP header and certain other HTTP headers, which set the ip variable that is used in SQL queries performed by index.php and certain other PHP scripts. NOTE: the attack vector might involve _SERVER.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Jupiter Cms	Jupiter Cms

Configuration 1 [-]

cpe:2.3:a:jupiter_cms:jupiter_cms:1.1.5:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://mgsdl.free.fr/advisories/12070214.txt
http://osvdb.org/33727
http://www.acid-root.new.fr/advisories/12070214.txt
http://www.securityfocus.com/archive/1/460076/100/0/threaded
http://www.securityfocus.com/archive/1/460100/100/0/threaded
http://www.securityfocus.com/bid/22560
https://www.exploit-db.com/exploits/3310

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2007-02-16T01:00:00

Updated: 2024-08-07T12:34:21.378Z

Reserved: 2007-02-15T00:00:00

Link: CVE-2007-0971

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2007-02-16T01:28:00.000

Modified: 2025-04-09T00:30:58.490

Link: CVE-2007-0971

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2007-02-14T00:00:00", "descriptions": [{"lang": "en", "value": "Multiple SQL injection vulnerabilities in Jupiter CMS 1.1.5 allow remote attackers to execute arbitrary SQL commands via the Client-IP HTTP header and certain other HTTP headers, which set the ip variable that is used in SQL queries performed by index.php and certain other PHP scripts. NOTE: the attack vector might involve _SERVER."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-16T14:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "http://mgsdl.free.fr/advisories/12070214.txt"}, {"name": "33727", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/33727"}, {"name": "3310", "tags": ["exploit", "x_refsource_EXPLOIT-DB"], "url": "https://www.exploit-db.com/exploits/3310"}, {"name": "22560", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/22560"}, {"name": "20070214 Jupiter CMS 1.1.5 Multiple Vulnerabilities", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/460076/100/0/threaded"}, {"name": "20070214 Re: Jupiter CMS 1.1.5 Multiple Vulnerabilities", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/460100/100/0/threaded"}, {"tags": ["x_refsource_MISC"], "url": "http://www.acid-root.new.fr/advisories/12070214.txt"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "[email protected]", "ID": "CVE-2007-0971", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Multiple SQL injection vulnerabilities in Jupiter CMS 1.1.5 allow remote attackers to execute arbitrary SQL commands via the Client-IP HTTP header and certain other HTTP headers, which set the ip variable that is used in SQL queries performed by index.php and certain other PHP scripts. NOTE: the attack vector might involve _SERVER."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://mgsdl.free.fr/advisories/12070214.txt", "refsource": "MISC", "url": "http://mgsdl.free.fr/advisories/12070214.txt"}, {"name": "33727", "refsource": "OSVDB", "url": "http://osvdb.org/33727"}, {"name": "3310", "refsource": "EXPLOIT-DB", "url": "https://www.exploit-db.com/exploits/3310"}, {"name": "22560", "refsource": "BID", "url": "http://www.securityfocus.com/bid/22560"}, {"name": "20070214 Jupiter CMS 1.1.5 Multiple Vulnerabilities", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/460076/100/0/threaded"}, {"name": "20070214 Re: Jupiter CMS 1.1.5 Multiple Vulnerabilities", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/460100/100/0/threaded"}, {"name": "http://www.acid-root.new.fr/advisories/12070214.txt", "refsource": "MISC", "url": "http://www.acid-root.new.fr/advisories/12070214.txt"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T12:34:21.378Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://mgsdl.free.fr/advisories/12070214.txt"}, {"name": "33727", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/33727"}, {"name": "3310", "tags": ["exploit", "x_refsource_EXPLOIT-DB", "x_transferred"], "url": "https://www.exploit-db.com/exploits/3310"}, {"name": "22560", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/22560"}, {"name": "20070214 Jupiter CMS 1.1.5 Multiple Vulnerabilities", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/460076/100/0/threaded"}, {"name": "20070214 Re: Jupiter CMS 1.1.5 Multiple Vulnerabilities", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/460100/100/0/threaded"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.acid-root.new.fr/advisories/12070214.txt"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2007-0971", "datePublished": "2007-02-16T01:00:00", "dateReserved": "2007-02-15T00:00:00", "dateUpdated": "2024-08-07T12:34:21.378Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:jupiter_cms:jupiter_cms:1.1.5:*:*:*:*:*:*:*", "matchCriteriaId": "EB372559-61D8-4E8D-9ED2-DB7F211E8C78", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Multiple SQL injection vulnerabilities in Jupiter CMS 1.1.5 allow remote attackers to execute arbitrary SQL commands via the Client-IP HTTP header and certain other HTTP headers, which set the ip variable that is used in SQL queries performed by index.php and certain other PHP scripts. NOTE: the attack vector might involve _SERVER."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de inyecci\u00f3n SQL en Jupiter CMS 1.1.5 permiten a atacantes remotos ejecutar comandos SQL de su elecci\u00f3n mediante la cabecera HTTP Client-IP y otras cabeceras HTTP concretas, que asignan valor a la variable ip que se usa en consultas SQL ejecutadas por index.pjp y otros scripts PHP concretos.\r\nNOTA: el vector de ataque podr\u00eda involucrar _SERVER."}], "id": "CVE-2007-0971", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "[email protected]", "type": "Primary", "userInteractionRequired": false}]}, "published": "2007-02-16T01:28:00.000", "references": [{"source": "[email protected]", "tags": ["Vendor Advisory"], "url": "http://mgsdl.free.fr/advisories/12070214.txt"}, {"source": "[email protected]", "url": "http://osvdb.org/33727"}, {"source": "[email protected]", "tags": ["Vendor Advisory"], "url": "http://www.acid-root.new.fr/advisories/12070214.txt"}, {"source": "[email protected]", "url": "http://www.securityfocus.com/archive/1/460076/100/0/threaded"}, {"source": "[email protected]", "url": "http://www.securityfocus.com/archive/1/460100/100/0/threaded"}, {"source": "[email protected]", "tags": ["Exploit"], "url": "http://www.securityfocus.com/bid/22560"}, {"source": "[email protected]", "url": "https://www.exploit-db.com/exploits/3310"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://mgsdl.free.fr/advisories/12070214.txt"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://osvdb.org/33727"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://www.acid-root.new.fr/advisories/12070214.txt"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/460076/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/460100/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://www.securityfocus.com/bid/22560"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.exploit-db.com/exploits/3310"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "[email protected]", "type": "Primary"}]}