Unscored CVE-2007-0350 EUVD-2007-0352GHSA-8664-h656-jrxr

Multiple SQL injection vulnerabilities in (a) index.php and (b) dl.php in SmE FileMailer 1.21 and earlier allow remote attackers to execute…

Published Jan 19, 2007 · Updated Aug 7, 2024 · Assigned by mitre

Description

Multiple SQL injection vulnerabilities in (a) index.php and (b) dl.php in SmE FileMailer 1.21 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) ps, (2) us, (3) f, or (4) code parameter. NOTE: the us vector in index.php is already covered by CVE-2007-0346.

References

20070117 Source VERIFY of SMe FileMailer 1.21 SQL injection mailing-list
20070116 [x0n3-h4ck] SmE FileMailer 1.21 Remote Sql Injextion Exploit mailing-list
smefilemailer-login-sql-injection(31533) vdb-entry
32833 vdb-entry
ADV-2007-0221 vdb-entry