CVE-2007-1329
- State
- Published
- Severity
- Not scored
- Published
- Mar 7, 2007
- Updated
- Aug 7, 2024
- Reserved
- Mar 7, 2007
Description
Directory traversal vulnerability in SQL-Ledger, and LedgerSMB before 1.1.5, allows remote attackers to read and overwrite arbitrary files, and execute arbitrary code, via . (dot) characters adjacent to (1) users and (2) users/members strings, which are removed by blacklisting functions that filter these strings and collapse into .. (dot dot) sequences.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- 24363third-party-advisory
- 33619vdb-entry
- 33621vdb-entry
- 20070301 Full disclosure: Directory Transversal and Arbitrary Code Execution Vulnerability in SQL-Ledger and LedgerSMBmailing-list
- 2381third-party-advisory
- 24366third-party-advisory
- sqlledger-userpathmemberfile-dir-traversal(32776)vdb-entry
- 1017715vdb-entry
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.