Multiple SQL injection vulnerabilities in MKPortal 1.1.1 allow remote attackers to execute arbitrary SQL commands via (1) the idurlo field in the delete_urlo function in (a) index.php in the urlobox module; the iden field in the (2) update_file and (3) del_file functions in (b) index.php in the reviews module; the (4) idnews field in the delete_news function and the (5) idcomm field in the del_comment function in (c) index.php in the news module; the (6) idcomm field in the delete_comments function in (d) index.php in the gallery module; the iden field in the (7) edit_file, (8) update_file, and (9) del_file functions in index.php in the gallery module; the (10) ide and (11) cat fields in the slide_update function in index.php in the gallery module; the iden field in the (12) update_file and (13) del_file functions in (d) index.php in the downloads module; and other unspecified vectors.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2007-07-17T00:00:00

Updated: 2024-08-07T14:28:52.513Z

Reserved: 2007-07-16T00:00:00

Link: CVE-2007-3814

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2007-07-17T00:30:00.000

Modified: 2024-11-21T00:34:07.630

Link: CVE-2007-3814

cve-icon Redhat

No data.