{"api_version":"1","generated_at":"2026-07-23T05:03:00+00:00","cve":"CVE-2007-4804","urls":{"html":"https://cve.report/CVE-2007-4804","api":"https://cve.report/api/cve/CVE-2007-4804.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2007-4804","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2007-4804"},"summary":{"title":"CVE-2007-4804","description":"Multiple SQL injection vulnerabilities in AuraCMS 1.5rc allow remote attackers to execute arbitrary SQL commands via the id parameter in (1) hal.php, (2) cetak.php, (3) lihat.php, (4) pesan.php, and (5) teman.php, different vectors than CVE-2007-4171.  NOTE: the scripts may be accessed through requests to the product's top-level default URI, using the pilih parameter, in some circumstances.","state":"PUBLISHED","assigner":"mitre","published_at":"2007-09-11 18:17:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-89","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/36519","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/36519","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.exploit-db.com/exploits/4385","name":"https://www.exploit-db.com/exploits/4385","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"AuraCMS 1.5rc Multiple Remote SQL Injection Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://osvdb.org/38413","name":"http://osvdb.org/38413","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://osvdb.org/38412","name":"http://osvdb.org/38412","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://osvdb.org/38411","name":"http://osvdb.org/38411","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://osvdb.org/38410","name":"http://osvdb.org/38410","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://osvdb.org/38409","name":"http://osvdb.org/38409","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.securityfocus.com/bid/25614","name":"http://www.securityfocus.com/bid/25614","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"AuraCMS ID Parameter Multiple SQL Injection Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2007-4804","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-4804","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2007","cve_id":"4804","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"auracms","cpe5":"auracms","cpe6":"1.5_rc","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T15:08:33.767Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"auracms-multiple-sql-injection(36519)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/36519"},{"name":"38411","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/38411"},{"name":"38412","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/38412"},{"name":"38413","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/38413"},{"name":"25614","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/25614"},{"name":"38409","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/38409"},{"name":"38410","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/38410"},{"name":"4385","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"],"url":"https://www.exploit-db.com/exploits/4385"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2007-09-09T00:00:00.000Z","descriptions":[{"lang":"en","value":"Multiple SQL injection vulnerabilities in AuraCMS 1.5rc allow remote attackers to execute arbitrary SQL commands via the id parameter in (1) hal.php, (2) cetak.php, (3) lihat.php, (4) pesan.php, and (5) teman.php, different vectors than CVE-2007-4171.  NOTE: the scripts may be accessed through requests to the product's top-level default URI, using the pilih parameter, in some circumstances."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-09-28T12:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"auracms-multiple-sql-injection(36519)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/36519"},{"name":"38411","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/38411"},{"name":"38412","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/38412"},{"name":"38413","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/38413"},{"name":"25614","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/25614"},{"name":"38409","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/38409"},{"name":"38410","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/38410"},{"name":"4385","tags":["exploit","x_refsource_EXPLOIT-DB"],"url":"https://www.exploit-db.com/exploits/4385"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2007-4804","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple SQL injection vulnerabilities in AuraCMS 1.5rc allow remote attackers to execute arbitrary SQL commands via the id parameter in (1) hal.php, (2) cetak.php, (3) lihat.php, (4) pesan.php, and (5) teman.php, different vectors than CVE-2007-4171.  NOTE: the scripts may be accessed through requests to the product's top-level default URI, using the pilih parameter, in some circumstances."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"auracms-multiple-sql-injection(36519)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/36519"},{"name":"38411","refsource":"OSVDB","url":"http://osvdb.org/38411"},{"name":"38412","refsource":"OSVDB","url":"http://osvdb.org/38412"},{"name":"38413","refsource":"OSVDB","url":"http://osvdb.org/38413"},{"name":"25614","refsource":"BID","url":"http://www.securityfocus.com/bid/25614"},{"name":"38409","refsource":"OSVDB","url":"http://osvdb.org/38409"},{"name":"38410","refsource":"OSVDB","url":"http://osvdb.org/38410"},{"name":"4385","refsource":"EXPLOIT-DB","url":"https://www.exploit-db.com/exploits/4385"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2007-4804","datePublished":"2007-09-11T18:00:00.000Z","dateReserved":"2007-09-11T00:00:00.000Z","dateUpdated":"2024-08-07T15:08:33.767Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2007-09-11 18:17:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-89","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":true,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:auracms:auracms:1.5_rc:*:*:*:*:*:*:*","matchCriteriaId":"40EEBB69-EE82-40C9-AE4E-BAEEB48FCE88"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2007","CveId":"4804","Ordinal":"1","Title":"CVE-2007-4804","CVE":"CVE-2007-4804","Year":"2007"},"notes":[{"CveYear":"2007","CveId":"4804","Ordinal":"1","NoteData":"Multiple SQL injection vulnerabilities in AuraCMS 1.5rc allow remote attackers to execute arbitrary SQL commands via the id parameter in (1) hal.php, (2) cetak.php, (3) lihat.php, (4) pesan.php, and (5) teman.php, different vectors than CVE-2007-4171.  NOTE: the scripts may be accessed through requests to the product's top-level default URI, using the pilih parameter, in some circumstances.","Type":"Description","Title":"CVE-2007-4804"},{"CveYear":"2007","CveId":"4804","Ordinal":"2","NoteData":"2007-09-11","Type":"Other","Title":"Published"},{"CveYear":"2007","CveId":"4804","Ordinal":"3","NoteData":"2017-09-28","Type":"Other","Title":"Modified"}]}}}