{"api_version":"1","generated_at":"2026-07-23T12:05:20+00:00","cve":"CVE-2007-1974","urls":{"html":"https://cve.report/CVE-2007-1974","api":"https://cve.report/api/cve/CVE-2007-1974.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2007-1974","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2007-1974"},"summary":{"title":"CVE-2007-1974","description":"SQL injection vulnerability in the getArticle function in class/wfsarticle.php in WF-Section (aka WF-Sections) 1.0.1, as used in Xoops modules such as (1) Zmagazine 1.0, (2) Happy Linux XFsection 1.07 and earlier, and possibly other modules, allows remote attackers to execute arbitrary SQL commands via the articleid parameter to print.php.","state":"PUBLISHED","assigner":"mitre","published_at":"2007-04-12 00:19:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["NVD-CWE-Other","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://www.xoops.org/modules/newbb/viewtopic.php?viewmode=flat&order=ASC&topic_id=58229&forum=4&move=next&topic_time=1176217411","name":"http://www.xoops.org/modules/newbb/viewtopic.php?viewmode=flat&order=ASC&topic_id=58229&forum=4&move=next&topic_time=1176217411","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"XOOPS Project - WF-Sections V2.08 Released (PHP5 Update) [Support Forums - Module usage questions]","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://osvdb.org/41387","name":"http://osvdb.org/41387","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.xoops.org/modules/news/article.php?storyid=3717","name":"http://www.xoops.org/modules/news/article.php?storyid=3717","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"XOOPS Project - WF-Sections 1.02 (Security BugFix) - Modules - XOOPS News","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/archive/1/488317/100/0/threaded","name":"http://www.securityfocus.com/archive/1/488317/100/0/threaded","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/33380","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/33380","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/23258","name":"http://www.securityfocus.com/bid/23258","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"XOOPS Module ZMagazine Print.PHP SQL Injection Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.vupen.com/english/advisories/2007/1208","name":"http://www.vupen.com/english/advisories/2007/1208","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.exploit-db.com/exploits/3646","name":"https://www.exploit-db.com/exploits/3646","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"XOOPS Module Zmagazine 1.0 - 'print.php' SQL Injection - PHP webapps Exploit","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/23261","name":"http://www.securityfocus.com/bid/23261","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"XFSection Xoops Module Print.PHP SQL Injection Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.vupen.com/english/advisories/2007/1207","name":"http://www.vupen.com/english/advisories/2007/1207","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2007/1209","name":"http://www.vupen.com/english/advisories/2007/1209","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://addons.zarilia.com/index.php?page_type=static&id=43","name":"http://addons.zarilia.com/index.php?page_type=static&id=43","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"","mime":"inode/x-empty","httpstatus":"-1","archivestatus":"200"},{"url":"https://www.exploit-db.com/exploits/3644","name":"https://www.exploit-db.com/exploits/3644","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"XOOPS Module WF-Section <= 1.01 (articleid) SQL Injection Exploit","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.attrition.org/pipermail/vim/2007-April/001507.html","name":"http://www.attrition.org/pipermail/vim/2007-April/001507.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"[VIM] WF-Sections SQL injection vendor ack;\tshows up in other modules","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/23259","name":"http://www.securityfocus.com/bid/23259","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"XOOPS WF-Section Module Print.PHP SQL Injection Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.exploit-db.com/exploits/3645","name":"https://www.exploit-db.com/exploits/3645","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"XOOPS Module XFsection 1.07 - 'articleId' Blind SQL Injection - PHP webapps Exploit","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/33379","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/33379","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/33378","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/33378","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://osvdb.org/52230","name":"http://osvdb.org/52230","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2007-1974","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-1974","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2007","cve_id":"1974","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wf-sections","cpe5":"wf-sections","cpe6":"1.0.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2007","cve_id":"1974","vulnerable":"1","versionEndIncluding":"1.07","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"xoops","cpe5":"happy_linux_xfsection_module","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2007","cve_id":"1974","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"xoops","cpe5":"zmagazine_module","cpe6":"1.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T13:13:42.000Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.xoops.org/modules/news/article.php?storyid=3717"},{"name":"23258","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/23258"},{"name":"41387","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/41387"},{"name":"xoops-wfsection-print-sql-injection(33378)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/33378"},{"name":"3646","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"],"url":"https://www.exploit-db.com/exploits/3646"},{"name":"ADV-2007-1209","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2007/1209"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.xoops.org/modules/newbb/viewtopic.php?viewmode=flat&order=ASC&topic_id=58229&forum=4&move=next&topic_time=1176217411"},{"name":"20080218 XOOPS Module section SQL Injection(articleid)","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/488317/100/0/threaded"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://addons.zarilia.com/index.php?page_type=static&id=43"},{"name":"xoops-xfsection-print-sql-injection(33380)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/33380"},{"name":"23261","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/23261"},{"name":"23259","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/23259"},{"name":"52230","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/52230"},{"name":"xoops-zmagazine-print-sql-injection(33379)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/33379"},{"name":"20070411 WF-Sections SQL injection vendor ack; shows up in other modules","tags":["mailing-list","x_refsource_VIM","x_transferred"],"url":"http://www.attrition.org/pipermail/vim/2007-April/001507.html"},{"name":"3645","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"],"url":"https://www.exploit-db.com/exploits/3645"},{"name":"ADV-2007-1208","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2007/1208"},{"name":"ADV-2007-1207","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2007/1207"},{"name":"3644","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"],"url":"https://www.exploit-db.com/exploits/3644"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2007-04-02T00:00:00.000Z","descriptions":[{"lang":"en","value":"SQL injection vulnerability in the getArticle function in class/wfsarticle.php in WF-Section (aka WF-Sections) 1.0.1, as used in Xoops modules such as (1) Zmagazine 1.0, (2) Happy Linux XFsection 1.07 and earlier, and possibly other modules, allows remote attackers to execute arbitrary SQL commands via the articleid parameter to print.php."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2018-10-16T14:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"tags":["x_refsource_CONFIRM"],"url":"http://www.xoops.org/modules/news/article.php?storyid=3717"},{"name":"23258","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/23258"},{"name":"41387","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/41387"},{"name":"xoops-wfsection-print-sql-injection(33378)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/33378"},{"name":"3646","tags":["exploit","x_refsource_EXPLOIT-DB"],"url":"https://www.exploit-db.com/exploits/3646"},{"name":"ADV-2007-1209","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2007/1209"},{"tags":["x_refsource_MISC"],"url":"http://www.xoops.org/modules/newbb/viewtopic.php?viewmode=flat&order=ASC&topic_id=58229&forum=4&move=next&topic_time=1176217411"},{"name":"20080218 XOOPS Module section SQL Injection(articleid)","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/488317/100/0/threaded"},{"tags":["x_refsource_CONFIRM"],"url":"http://addons.zarilia.com/index.php?page_type=static&id=43"},{"name":"xoops-xfsection-print-sql-injection(33380)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/33380"},{"name":"23261","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/23261"},{"name":"23259","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/23259"},{"name":"52230","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/52230"},{"name":"xoops-zmagazine-print-sql-injection(33379)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/33379"},{"name":"20070411 WF-Sections SQL injection vendor ack; shows up in other modules","tags":["mailing-list","x_refsource_VIM"],"url":"http://www.attrition.org/pipermail/vim/2007-April/001507.html"},{"name":"3645","tags":["exploit","x_refsource_EXPLOIT-DB"],"url":"https://www.exploit-db.com/exploits/3645"},{"name":"ADV-2007-1208","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2007/1208"},{"name":"ADV-2007-1207","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2007/1207"},{"name":"3644","tags":["exploit","x_refsource_EXPLOIT-DB"],"url":"https://www.exploit-db.com/exploits/3644"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2007-1974","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"SQL injection vulnerability in the getArticle function in class/wfsarticle.php in WF-Section (aka WF-Sections) 1.0.1, as used in Xoops modules such as (1) Zmagazine 1.0, (2) Happy Linux XFsection 1.07 and earlier, and possibly other modules, allows remote attackers to execute arbitrary SQL commands via the articleid parameter to print.php."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"http://www.xoops.org/modules/news/article.php?storyid=3717","refsource":"CONFIRM","url":"http://www.xoops.org/modules/news/article.php?storyid=3717"},{"name":"23258","refsource":"BID","url":"http://www.securityfocus.com/bid/23258"},{"name":"41387","refsource":"OSVDB","url":"http://osvdb.org/41387"},{"name":"xoops-wfsection-print-sql-injection(33378)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/33378"},{"name":"3646","refsource":"EXPLOIT-DB","url":"https://www.exploit-db.com/exploits/3646"},{"name":"ADV-2007-1209","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2007/1209"},{"name":"http://www.xoops.org/modules/newbb/viewtopic.php?viewmode=flat&order=ASC&topic_id=58229&forum=4&move=next&topic_time=1176217411","refsource":"MISC","url":"http://www.xoops.org/modules/newbb/viewtopic.php?viewmode=flat&order=ASC&topic_id=58229&forum=4&move=next&topic_time=1176217411"},{"name":"20080218 XOOPS Module section SQL Injection(articleid)","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/488317/100/0/threaded"},{"name":"http://addons.zarilia.com/index.php?page_type=static&id=43","refsource":"CONFIRM","url":"http://addons.zarilia.com/index.php?page_type=static&id=43"},{"name":"xoops-xfsection-print-sql-injection(33380)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/33380"},{"name":"23261","refsource":"BID","url":"http://www.securityfocus.com/bid/23261"},{"name":"23259","refsource":"BID","url":"http://www.securityfocus.com/bid/23259"},{"name":"52230","refsource":"OSVDB","url":"http://osvdb.org/52230"},{"name":"xoops-zmagazine-print-sql-injection(33379)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/33379"},{"name":"20070411 WF-Sections SQL injection vendor ack; shows up in other modules","refsource":"VIM","url":"http://www.attrition.org/pipermail/vim/2007-April/001507.html"},{"name":"3645","refsource":"EXPLOIT-DB","url":"https://www.exploit-db.com/exploits/3645"},{"name":"ADV-2007-1208","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2007/1208"},{"name":"ADV-2007-1207","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2007/1207"},{"name":"3644","refsource":"EXPLOIT-DB","url":"https://www.exploit-db.com/exploits/3644"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2007-1974","datePublished":"2007-04-12T00:00:00.000Z","dateReserved":"2007-04-11T00:00:00.000Z","dateUpdated":"2024-08-07T13:13:42.000Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2007-04-12 00:19:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["NVD-CWE-Other","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":true,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:wf-sections:wf-sections:1.0.1:*:*:*:*:*:*:*","matchCriteriaId":"ECF5E450-578F-4DAA-BC2B-42B90512EF91"},{"vulnerable":true,"criteria":"cpe:2.3:a:xoops:happy_linux_xfsection_module:*:*:*:*:*:*:*:*","versionEndIncluding":"1.07","matchCriteriaId":"8FE72AA9-D4F3-48D8-96A6-D5025547E780"},{"vulnerable":true,"criteria":"cpe:2.3:a:xoops:zmagazine_module:1.0:*:*:*:*:*:*:*","matchCriteriaId":"0784FC8A-0285-4BDD-84D3-DAAF8855B56D"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2007","CveId":"1974","Ordinal":"1","Title":"CVE-2007-1974","CVE":"CVE-2007-1974","Year":"2007"},"notes":[{"CveYear":"2007","CveId":"1974","Ordinal":"1","NoteData":"SQL injection vulnerability in the getArticle function in class/wfsarticle.php in WF-Section (aka WF-Sections) 1.0.1, as used in Xoops modules such as (1) Zmagazine 1.0, (2) Happy Linux XFsection 1.07 and earlier, and possibly other modules, allows remote attackers to execute arbitrary SQL commands via the articleid parameter to print.php.","Type":"Description","Title":"CVE-2007-1974"},{"CveYear":"2007","CveId":"1974","Ordinal":"2","NoteData":"2007-04-11","Type":"Other","Title":"Published"},{"CveYear":"2007","CveId":"1974","Ordinal":"3","NoteData":"2018-10-16","Type":"Other","Title":"Modified"}]}}}