CVE-2007-6380 - CVE House
Back to Database
Status published High CVE-2007-6380

Multiple SQL injection vulnerabilities in e-Xoops (exoops) 1.08, and 1.05...

Vulnerability Description

Multiple SQL injection vulnerabilities in e-Xoops (exoops) 1.08, and 1.05 Rev 1 through 3, allow remote attackers to execute arbitrary SQL commands via the (1) lid parameter to (a) mylinks/ratelink.php, (b) adresses/ratefile.php, (c) mydownloads/ratefile.php, (d) mysections/ratefile.php, and (e) myalbum/ratephoto.php in modules/; the (2) bid parameter to (f) modules/banners/click.php; and the (3) gid parameter to (g) modules/arcade/index.php in a show_stats and play_game action, related issues to CVE-2007-5104 and CVE-2007-6266.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2007-6380

Credits & Attribution

No credits recorded in the NVD database.

References

More from e-xoops

View All →
CVE-2008-7036
Multiple cross-site scripting (XSS) vulnerabilities in index.php in DevTracker module...
Medium 4.3
CVE-2005-1031
RUNCMS 1.1A, and possibly other products based on e-Xoops (exoops),...
Medium 5
CVE-2005-0911
Multiple SQL injection vulnerabilities in exoops may allow remote attackers...
High 7.5
CVE-2005-0910
Multiple cross-site scripting (XSS) vulnerabilities in exoops allow remote attackers...
Medium 4.3

Affected Vendor

Affected Software

e-xoops
Vulnerable Versions:
1.05_rev1, 1.05_rev2, 1.05_rev3, 1.08

Timeline

Official Publish: December 15th, 2007
Last Modified: September 16th, 2024
Added to House: July 18th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.