CVE-2007-5372

Multiple SQL injection vulnerabilities in (a) LedgerSMB 1.0.0 through 1.2.7 and (b) DWS Systems SQL-Ledger 2.x allow remote attackers to execute arbitrary SQL commands via (1) the invoice quantity field or (2) the sort field.

🔗 References (22)

• cve@mitrehttp://osvdb.org/37865
• cve@mitrehttp://osvdb.org/37866
• cve@mitrehttp://secunia.com/advisories/27159
• cve@mitrehttp://secunia.com/advisories/27171
• cve@mitrehttp://securityreason.com/securityalert/3209
• cve@mitrehttp://www.ledgersmb.org/node/54
• cve@mitrehttp://www.securityfocus.com/archive/1/481866/100/0/threaded
• cve@mitrehttp://www.securityfocus.com/bid/25979
• cve@mitrehttp://www.vupen.com/english/advisories/2007/3453
• cve@mitrehttps://exchange.xforce.ibmcloud.com/vulnerabilities/37032
• cve@mitrehttps://exchange.xforce.ibmcloud.com/vulnerabilities/37033
• af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/37865
• af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/37866
• af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/27159
• af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/27171