{"api_version":"1","generated_at":"2026-07-23T13:35:06+00:00","cve":"CVE-2007-2305","urls":{"html":"https://cve.report/CVE-2007-2305","api":"https://cve.report/api/cve/CVE-2007-2305.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2007-2305","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2007-2305"},"summary":{"title":"CVE-2007-2305","description":"Multiple SQL injection vulnerabilities in authenticate.php in Quick and Dirty Blog (QDBlog) 0.4, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.","state":"PUBLISHED","assigner":"mitre","published_at":"2007-04-26 21:19:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["NVD-CWE-Other","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://www.securityfocus.com/bid/23485","name":"http://www.securityfocus.com/bid/23485","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"QDBlog Multiple Scripts Multiple Input Validation Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.vupen.com/english/advisories/2007/1387","name":"http://www.vupen.com/english/advisories/2007/1387","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://osvdb.org/35746","name":"http://osvdb.org/35746","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"https://www.exploit-db.com/exploits/3729","name":"https://www.exploit-db.com/exploits/3729","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"qdblog 0.4 (SQL Injection/lfi) Multiple Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/33631","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/33631","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2007-2305","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-2305","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2007","cve_id":"2305","vulnerable":"1","versionEndIncluding":"0.4","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"qdblog","cpe5":"qdblog","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T13:33:28.327Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"qdblog-login-sql-injection(33631)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/33631"},{"name":"ADV-2007-1387","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2007/1387"},{"name":"3729","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"],"url":"https://www.exploit-db.com/exploits/3729"},{"name":"23485","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/23485"},{"name":"35746","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/35746"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2007-04-16T00:00:00.000Z","descriptions":[{"lang":"en","value":"Multiple SQL injection vulnerabilities in authenticate.php in Quick and Dirty Blog (QDBlog) 0.4, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-10-10T00:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"qdblog-login-sql-injection(33631)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/33631"},{"name":"ADV-2007-1387","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2007/1387"},{"name":"3729","tags":["exploit","x_refsource_EXPLOIT-DB"],"url":"https://www.exploit-db.com/exploits/3729"},{"name":"23485","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/23485"},{"name":"35746","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/35746"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2007-2305","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple SQL injection vulnerabilities in authenticate.php in Quick and Dirty Blog (QDBlog) 0.4, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"qdblog-login-sql-injection(33631)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/33631"},{"name":"ADV-2007-1387","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2007/1387"},{"name":"3729","refsource":"EXPLOIT-DB","url":"https://www.exploit-db.com/exploits/3729"},{"name":"23485","refsource":"BID","url":"http://www.securityfocus.com/bid/23485"},{"name":"35746","refsource":"OSVDB","url":"http://osvdb.org/35746"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2007-2305","datePublished":"2007-04-26T21:00:00.000Z","dateReserved":"2007-04-26T00:00:00.000Z","dateUpdated":"2024-08-07T13:33:28.327Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2007-04-26 21:19:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["NVD-CWE-Other","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":true,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:qdblog:qdblog:*:*:*:*:*:*:*:*","versionEndIncluding":"0.4","matchCriteriaId":"94FE4E17-DAC4-4381-A400-5BDC8DE8A791"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2007","CveId":"2305","Ordinal":"1","Title":"CVE-2007-2305","CVE":"CVE-2007-2305","Year":"2007"},"notes":[{"CveYear":"2007","CveId":"2305","Ordinal":"1","NoteData":"Multiple SQL injection vulnerabilities in authenticate.php in Quick and Dirty Blog (QDBlog) 0.4, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.","Type":"Description","Title":"CVE-2007-2305"},{"CveYear":"2007","CveId":"2305","Ordinal":"2","NoteData":"2007-04-26","Type":"Other","Title":"Published"},{"CveYear":"2007","CveId":"2305","Ordinal":"3","NoteData":"2017-10-09","Type":"Other","Title":"Modified"}]}}}