{"api_version":"1","generated_at":"2026-07-23T05:46:41+00:00","cve":"CVE-2007-1960","urls":{"html":"https://cve.report/CVE-2007-1960","api":"https://cve.report/api/cve/CVE-2007-1960.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2007-1960","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2007-1960"},"summary":{"title":"CVE-2007-1960","description":"SQL injection vulnerability in visit.php in the Rha7 Downloads (rha7downloads) 1.0 module for XOOPS, and possibly other versions up to 1.10, allows remote attackers to execute arbitrary SQL commands via the lid parameter.","state":"PUBLISHED","assigner":"mitre","published_at":"2007-04-11 10:19:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-89","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://osvdb.org/34460","name":"http://osvdb.org/34460","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.securityfocus.com/bid/23320","name":"http://www.securityfocus.com/bid/23320","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"XOOPS Rha7 Downloads Module Visit.PHP SQL Injection Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://secunia.com/advisories/24790","name":"http://secunia.com/advisories/24790","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Xoops Rha7 Downloads Module \"lid\" SQL Injection - Advisories - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.exploit-db.com/exploits/3666","name":"https://www.exploit-db.com/exploits/3666","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"XOOPS Module Rha7 Downloads 1.0 - 'visit.php' SQL Injection - PHP webapps Exploit","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2007-1960","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-1960","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2007","cve_id":"1960","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"xoops","cpe5":"rha7_downloads_module","cpe6":"1.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2007","cve_id":"1960","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"xoops","cpe5":"rha7_downloads_module","cpe6":"1.10","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T13:13:42.000Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"34460","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/34460"},{"name":"23320","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/23320"},{"name":"24790","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/24790"},{"name":"3666","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"],"url":"https://www.exploit-db.com/exploits/3666"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2007-04-04T00:00:00.000Z","descriptions":[{"lang":"en","value":"SQL injection vulnerability in visit.php in the Rha7 Downloads (rha7downloads) 1.0 module for XOOPS, and possibly other versions up to 1.10, allows remote attackers to execute arbitrary SQL commands via the lid parameter."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-10-10T00:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"34460","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/34460"},{"name":"23320","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/23320"},{"name":"24790","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/24790"},{"name":"3666","tags":["exploit","x_refsource_EXPLOIT-DB"],"url":"https://www.exploit-db.com/exploits/3666"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2007-1960","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"SQL injection vulnerability in visit.php in the Rha7 Downloads (rha7downloads) 1.0 module for XOOPS, and possibly other versions up to 1.10, allows remote attackers to execute arbitrary SQL commands via the lid parameter."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"34460","refsource":"OSVDB","url":"http://osvdb.org/34460"},{"name":"23320","refsource":"BID","url":"http://www.securityfocus.com/bid/23320"},{"name":"24790","refsource":"SECUNIA","url":"http://secunia.com/advisories/24790"},{"name":"3666","refsource":"EXPLOIT-DB","url":"https://www.exploit-db.com/exploits/3666"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2007-1960","datePublished":"2007-04-11T10:00:00.000Z","dateReserved":"2007-04-10T00:00:00.000Z","dateUpdated":"2024-08-07T13:13:42.000Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2007-04-11 10:19:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-89","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":true,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:xoops:rha7_downloads_module:1.0:*:*:*:*:*:*:*","matchCriteriaId":"79ACCCF9-733A-4CE7-A588-C09BB54421B8"},{"vulnerable":true,"criteria":"cpe:2.3:a:xoops:rha7_downloads_module:1.10:*:*:*:*:*:*:*","matchCriteriaId":"CB8F8C65-E879-4EDC-9D97-7B51EF8CC65C"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2007","CveId":"1960","Ordinal":"1","Title":"CVE-2007-1960","CVE":"CVE-2007-1960","Year":"2007"},"notes":[{"CveYear":"2007","CveId":"1960","Ordinal":"1","NoteData":"SQL injection vulnerability in visit.php in the Rha7 Downloads (rha7downloads) 1.0 module for XOOPS, and possibly other versions up to 1.10, allows remote attackers to execute arbitrary SQL commands via the lid parameter.","Type":"Description","Title":"CVE-2007-1960"},{"CveYear":"2007","CveId":"1960","Ordinal":"2","NoteData":"2007-04-11","Type":"Other","Title":"Published"},{"CveYear":"2007","CveId":"1960","Ordinal":"3","NoteData":"2017-10-09","Type":"Other","Title":"Modified"}]}}}