CyberSec.Space Logo
Back to CVE Browser

CVE-2007-5372

CRITICAL
10.0
CVSS Severity Score
EPSS Score0.0590%
EPSS Percentile34.34th
PublishedOct 11, 2007
Last ModifiedApr 23, 2026

Vulnerability Description

Multiple SQL injection vulnerabilities in (a) LedgerSMB 1.0.0 through 1.2.7 and (b) DWS Systems SQL-Ledger 2.x allow remote attackers to execute arbitrary SQL commands via (1) the invoice quantity field or (2) the sort field.

Affected Platforms (CPE)

📦
Dws Systems Inc.

Sql Ledger

= 2.2.0
📦
Dws Systems Inc.

Sql Ledger

= 2.2.1
📦
Dws Systems Inc.

Sql Ledger

= 2.2.2
📦
Dws Systems Inc.

Sql Ledger

= 2.2.3
📦
Dws Systems Inc.

Sql Ledger

= 2.2.4
📦
Dws Systems Inc.

Sql Ledger

= 2.2.5
📦
Dws Systems Inc.

Sql Ledger

= 2.2.6
📦
Dws Systems Inc.

Sql Ledger

= 2.2.7
📦
Dws Systems Inc.

Sql Ledger

= 2.4.0
📦
Dws Systems Inc.

Sql Ledger

= 2.4.1
📦
Dws Systems Inc.

Sql Ledger

= 2.4.2
📦
Dws Systems Inc.

Sql Ledger

= 2.4.3
📦
Dws Systems Inc.

Sql Ledger

= 2.4.4
📦
Dws Systems Inc.

Sql Ledger

= 2.4.5
📦
Dws Systems Inc.

Sql Ledger

= 2.4.6
📦
Dws Systems Inc.

Sql Ledger

= 2.4.7
📦
Dws Systems Inc.

Sql Ledger

= 2.4.8
📦
Dws Systems Inc.

Sql Ledger

= 2.4.9
📦
Dws Systems Inc.

Sql Ledger

= 2.4.10
📦
Dws Systems Inc.

Sql Ledger

= 2.4.11
📦
Dws Systems Inc.

Sql Ledger

= 2.4.12
📦
Dws Systems Inc.

Sql Ledger

= 2.4.13
📦
Dws Systems Inc.

Sql Ledger

= 2.4.14
📦
Dws Systems Inc.

Sql Ledger

= 2.4.15
📦
Dws Systems Inc.

Sql Ledger

= 2.4.16
📦
Dws Systems Inc.

Sql Ledger

= 2.6.1
📦
Dws Systems Inc.

Sql Ledger

= 2.6.2
📦
Dws Systems Inc.

Sql Ledger

= 2.6.3
📦
Dws Systems Inc.

Sql Ledger

= 2.6.4
📦
Dws Systems Inc.

Sql Ledger

= 2.6.5
📦
Dws Systems Inc.

Sql Ledger

= 2.6.6
📦
Dws Systems Inc.

Sql Ledger

= 2.6.7
📦
Dws Systems Inc.

Sql Ledger

= 2.6.8
📦
Dws Systems Inc.

Sql Ledger

= 2.6.9
📦
Dws Systems Inc.

Sql Ledger

= 2.6.10
📦
Dws Systems Inc.

Sql Ledger

= 2.6.11
📦
Dws Systems Inc.

Sql Ledger

= 2.6.12
📦
Dws Systems Inc.

Sql Ledger

= 2.6.13
📦
Dws Systems Inc.

Sql Ledger

= 2.6.14
📦
Dws Systems Inc.

Sql Ledger

= 2.6.15
📦
Dws Systems Inc.

Sql Ledger

= 2.6.16
📦
Dws Systems Inc.

Sql Ledger

= 2.6.17
📦
Dws Systems Inc.

Sql Ledger

= 2.6.18
📦
Dws Systems Inc.

Sql Ledger

= 2.6.27
📦
Ledgersmb

Ledgersmb

= 1.0.0
📦
Ledgersmb

Ledgersmb

= 1.1.0
📦
Ledgersmb

Ledgersmb

= 1.1.1
📦
Ledgersmb

Ledgersmb

= 1.1.5
📦
Ledgersmb

Ledgersmb

= 1.1.8
📦
Ledgersmb

Ledgersmb

= 1.2.0
📦
Ledgersmb

Ledgersmb

= 1.2.1
📦
Ledgersmb

Ledgersmb

= 1.2.2
📦
Ledgersmb

Ledgersmb

= 1.2.3
📦
Ledgersmb

Ledgersmb

= 1.2.4
📦
Ledgersmb

Ledgersmb

= 1.2.5
📦
Ledgersmb

Ledgersmb

= 1.2.6
📦
Ledgersmb

Ledgersmb

= 1.2.7

References & Advisories

🔗 http://osvdb.org/37865
🔗 http://osvdb.org/37866
🔗 http://secunia.com/advisories/27159
🔗 http://secunia.com/advisories/27171
🔗 http://securityreason.com/securityalert/3209
🔗 http://www.ledgersmb.org/node/54
🔗 http://www.securityfocus.com/archive/1/481866/100/0/threaded
🔗 http://www.securityfocus.com/bid/25979

Related Vulnerabilities

CVE-2007-132910.0

Directory traversal vulnerability in SQL-Ledger, and LedgerSMB before 1.1.5, allows remote attackers to read and overwrite arbitra...

CVE-2007-14379.0

Unspecified vulnerability in LedgerSMB before 1.1.5 and SQL-Ledger before 2.6.25 allows remote attackers to overwrite files and po...

CVE-2008-40777.8

The CGI scripts in (1) LedgerSMB (LSMB) before 1.2.15 and (2) SQL-Ledger 2.8.17 and earlier allow remote attackers to cause a deni...

CVE-2006-42447.5

SQL-Ledger 2.4.4 through 2.6.17 authenticates users by verifying that the value of the sql-ledger-[username] cookie matches the va...