{"api_version":"1","generated_at":"2026-07-23T07:16:17+00:00","cve":"CVE-2007-4210","urls":{"html":"https://cve.report/CVE-2007-4210","api":"https://cve.report/api/cve/CVE-2007-4210.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2007-4210","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2007-4210"},"summary":{"title":"CVE-2007-4210","description":"Multiple SQL injection vulnerabilities in module.php in LANAI (la-nai) CMS 1.2.14 allow remote attackers to execute arbitrary SQL commands via (1) the mid parameter in an faqviewgroup action in the FAQ Modules, (2) the cid parameter in the EZSHOPINGCART Modules, or (3) the gid parameter in a view action in the GALLERY Modules.","state":"PUBLISHED","assigner":"mitre","published_at":"2007-08-08 02:17:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["NVD-CWE-Other","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://www.securityfocus.com/bid/25193","name":"http://www.securityfocus.com/bid/25193","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"LANAI CMS Multiple SQL Injection Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://securityreason.com/securityalert/2975","name":"http://securityreason.com/securityalert/2975","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"la-nai cms_v1.2.14 - Remote SQL Injection - CXSecurity.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://osvdb.org/36438","name":"http://osvdb.org/36438","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://secunia.com/advisories/26339","name":"http://secunia.com/advisories/26339","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"LANAI CMS module.php SQL Injection - Advisories - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://osvdb.org/37471","name":"http://osvdb.org/37471","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://osvdb.org/37470","name":"http://osvdb.org/37470","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.securityfocus.com/archive/1/475447","name":"http://www.securityfocus.com/archive/1/475447","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/35786","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/35786","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2007-4210","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-4210","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2007","cve_id":"4210","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redline_software","cpe5":"lanai_cms","cpe6":"1.2.14","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T14:46:39.385Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"37470","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/37470"},{"name":"37471","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/37471"},{"name":"20070802 la-nai cms_v1.2.14 - Remote SQL Injection","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/475447"},{"name":"lanai-module-sql-injection(35786)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/35786"},{"name":"36438","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/36438"},{"name":"2975","tags":["third-party-advisory","x_refsource_SREASON","x_transferred"],"url":"http://securityreason.com/securityalert/2975"},{"name":"26339","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/26339"},{"name":"25193","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/25193"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2007-08-02T00:00:00.000Z","descriptions":[{"lang":"en","value":"Multiple SQL injection vulnerabilities in module.php in LANAI (la-nai) CMS 1.2.14 allow remote attackers to execute arbitrary SQL commands via (1) the mid parameter in an faqviewgroup action in the FAQ Modules, (2) the cid parameter in the EZSHOPINGCART Modules, or (3) the gid parameter in a view action in the GALLERY Modules."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-07-28T12:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"37470","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/37470"},{"name":"37471","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/37471"},{"name":"20070802 la-nai cms_v1.2.14 - Remote SQL Injection","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/475447"},{"name":"lanai-module-sql-injection(35786)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/35786"},{"name":"36438","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/36438"},{"name":"2975","tags":["third-party-advisory","x_refsource_SREASON"],"url":"http://securityreason.com/securityalert/2975"},{"name":"26339","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/26339"},{"name":"25193","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/25193"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2007-4210","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple SQL injection vulnerabilities in module.php in LANAI (la-nai) CMS 1.2.14 allow remote attackers to execute arbitrary SQL commands via (1) the mid parameter in an faqviewgroup action in the FAQ Modules, (2) the cid parameter in the EZSHOPINGCART Modules, or (3) the gid parameter in a view action in the GALLERY Modules."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"37470","refsource":"OSVDB","url":"http://osvdb.org/37470"},{"name":"37471","refsource":"OSVDB","url":"http://osvdb.org/37471"},{"name":"20070802 la-nai cms_v1.2.14 - Remote SQL Injection","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/475447"},{"name":"lanai-module-sql-injection(35786)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/35786"},{"name":"36438","refsource":"OSVDB","url":"http://osvdb.org/36438"},{"name":"2975","refsource":"SREASON","url":"http://securityreason.com/securityalert/2975"},{"name":"26339","refsource":"SECUNIA","url":"http://secunia.com/advisories/26339"},{"name":"25193","refsource":"BID","url":"http://www.securityfocus.com/bid/25193"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2007-4210","datePublished":"2007-08-08T01:52:00.000Z","dateReserved":"2007-08-07T00:00:00.000Z","dateUpdated":"2024-08-07T14:46:39.385Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2007-08-08 02:17:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["NVD-CWE-Other","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:redline_software:lanai_cms:1.2.14:*:*:*:*:*:*:*","matchCriteriaId":"B0E757B1-244F-4FA5-850C-D28D5B00AA25"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2007","CveId":"4210","Ordinal":"1","Title":"CVE-2007-4210","CVE":"CVE-2007-4210","Year":"2007"},"notes":[{"CveYear":"2007","CveId":"4210","Ordinal":"1","NoteData":"Multiple SQL injection vulnerabilities in module.php in LANAI (la-nai) CMS 1.2.14 allow remote attackers to execute arbitrary SQL commands via (1) the mid parameter in an faqviewgroup action in the FAQ Modules, (2) the cid parameter in the EZSHOPINGCART Modules, or (3) the gid parameter in a view action in the GALLERY Modules.","Type":"Description","Title":"CVE-2007-4210"},{"CveYear":"2007","CveId":"4210","Ordinal":"2","NoteData":"2007-08-07","Type":"Other","Title":"Published"},{"CveYear":"2007","CveId":"4210","Ordinal":"3","NoteData":"2017-07-28","Type":"Other","Title":"Modified"}]}}}