HIGH🇵🇱 Wersja polska

CVE-2007-1541

CVSS 7.5v2.0pub. 2007-03-20upd. 2026-04-23

Directory traversal vulnerability in am.pl in SQL-Ledger 2.6.27 only checks for the presence of a NULL (%00) character to protect against directory traversal attacks, which allows remote attackers to run arbitrary executables and bypass authentication via a .. (dot dot) sequence in the login parameter.

CVSS Vector
AV:N/AC:L/Au:N/C:P/I:P/A:P

  • Sql Ledger

    APP
    Sql-Ledger
    2.6.27
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Path TraversalAuth Bypass
CWE
References

Related vulnerabilities

CVE-2009-4402HIGH7.5ten sam produkt

The default configuration of SQL-Ledger 2.8.24 allows remote attackers to perform unspecified administrative o...

CVE-2008-4077HIGH7.8ten sam produkt

The CGI scripts in (1) LedgerSMB (LSMB) before 1.2.15 and (2) SQL-Ledger 2.8.17 and earlier allow remote attac...

CVE-2007-1923HIGH7.5ten sam produkt

(1) LedgerSMB and (2) DWS Systems SQL-Ledger implement access control lists by changing the set of URLs linked...

CVE-2007-1437HIGH9.0ten sam produkt

Unspecified vulnerability in LedgerSMB before 1.1.5 and SQL-Ledger before 2.6.25 allows remote attackers to ov...

CVE-2007-1436HIGH7.5ten sam produkt

Unspecified vulnerability in admin.pl in SQL-Ledger before 2.6.26 and LedgerSMB before 1.1.9 allows remote att...