CVE-2007-5934
- State
- Published
- Severity
- Not scored
- Published
- Nov 13, 2007
- Updated
- Aug 7, 2024
- Reserved
- Nov 13, 2007
Description
The LOB functionality in PEAR MDB2 before 2.5.0a1 interprets a request to store a URL string as a request to retrieve and store the contents of the URL, which might allow remote attackers to use MDB2 as an indirect proxy or obtain sensitive information via a URL into a form field in an MDB2 application, as demonstrated by a file:// URL or a URL for an intranet web site.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- 26382vdb-entry
- http://bugs.gentoo.org/show_bug.cgi?id=198446
- http://pear.php.net/package/MDB2/download/2.5.0a1
- 42107vdb-entry
- GLSA-200712-05vendor-advisory
- http://pear.php.net/bugs/bug.php?id=10024
- 27983third-party-advisory
- 27626third-party-advisory
- [PEAR-CVS] 20070503 cvs: pear /MDB2 MDB2.php package.php /MDB2/MDB2/Driver mysql.php mysqli.php oci8.php pgsmailing-list
- 27572third-party-advisory
- FEDORA-2007-3369vendor-advisory
- ADV-2007-3806vdb-entry
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.