CVE-2007-5488 - Vulnerability Details - OpenCVE

Multiple SQL injection vulnerabilities in cdr_addon_mysql in Asterisk-Addons before 1.2.8, and 1.4.x before 1.4.4, allow remote attackers to execute arbitrary SQL commands via the (1) source and (2) destination numbers, and probably (3) SIP URI, when inserting a record.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Asterisk	Asterisk-addons

Configuration 1 [-]

OR	cpe:2.3:a:asterisk:asterisk-addons::::::::
	cpe:2.3:a:asterisk:asterisk-addons::::::::

No data.

References

Link	Providers
http://downloads.digium.com/pub/security/AST-2007-023.html
http://lists.grok.org.uk/pipermail/full-disclosure/2007-October/066744.html
http://osvdb.org/37880
http://secunia.com/advisories/27278
http://www.securityfocus.com/bid/26095
http://www.securitytracker.com/id?1018824
https://exchange.xforce.ibmcloud.com/vulnerabilities/37235

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2007-10-17T23:00:00

Updated: 2024-08-07T15:31:58.944Z

Reserved: 2007-10-16T00:00:00

Link: CVE-2007-5488

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2007-10-17T23:17:00.000

Modified: 2025-04-09T00:30:58.490

Link: CVE-2007-5488

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2007-10-16T00:00:00", "descriptions": [{"lang": "en", "value": "Multiple SQL injection vulnerabilities in cdr_addon_mysql in Asterisk-Addons before 1.2.8, and 1.4.x before 1.4.4, allow remote attackers to execute arbitrary SQL commands via the (1) source and (2) destination numbers, and probably (3) SIP URI, when inserting a record."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-07-28T12:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "37880", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/37880"}, {"name": "asterisk-cdraddonmysql-sql-injection(37235)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/37235"}, {"name": "1018824", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id?1018824"}, {"name": "27278", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/27278"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://downloads.digium.com/pub/security/AST-2007-023.html"}, {"name": "26095", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/26095"}, {"name": "20071017 AST-2007-023: SQL Injection POC and details", "tags": ["mailing-list", "x_refsource_FULLDISC"], "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2007-October/066744.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2007-5488", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Multiple SQL injection vulnerabilities in cdr_addon_mysql in Asterisk-Addons before 1.2.8, and 1.4.x before 1.4.4, allow remote attackers to execute arbitrary SQL commands via the (1) source and (2) destination numbers, and probably (3) SIP URI, when inserting a record."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "37880", "refsource": "OSVDB", "url": "http://osvdb.org/37880"}, {"name": "asterisk-cdraddonmysql-sql-injection(37235)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/37235"}, {"name": "1018824", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id?1018824"}, {"name": "27278", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/27278"}, {"name": "http://downloads.digium.com/pub/security/AST-2007-023.html", "refsource": "CONFIRM", "url": "http://downloads.digium.com/pub/security/AST-2007-023.html"}, {"name": "26095", "refsource": "BID", "url": "http://www.securityfocus.com/bid/26095"}, {"name": "20071017 AST-2007-023: SQL Injection POC and details", "refsource": "FULLDISC", "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2007-October/066744.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T15:31:58.944Z"}, "title": "CVE Program Container", "references": [{"name": "37880", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/37880"}, {"name": "asterisk-cdraddonmysql-sql-injection(37235)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/37235"}, {"name": "1018824", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id?1018824"}, {"name": "27278", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/27278"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://downloads.digium.com/pub/security/AST-2007-023.html"}, {"name": "26095", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/26095"}, {"name": "20071017 AST-2007-023: SQL Injection POC and details", "tags": ["mailing-list", "x_refsource_FULLDISC", "x_transferred"], "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2007-October/066744.html"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2007-5488", "datePublished": "2007-10-17T23:00:00", "dateReserved": "2007-10-16T00:00:00", "dateUpdated": "2024-08-07T15:31:58.944Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:asterisk:asterisk-addons:*:*:*:*:*:*:*:*", "matchCriteriaId": "B66E0B65-BE4E-454F-B4CC-BB10D5C0AC07", "versionEndIncluding": "1.2.7", "vulnerable": true}, {"criteria": "cpe:2.3:a:asterisk:asterisk-addons:*:*:*:*:*:*:*:*", "matchCriteriaId": "E55E3B14-E347-4592-9D79-304D3C4AC5D9", "versionEndIncluding": "1.4.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Multiple SQL injection vulnerabilities in cdr_addon_mysql in Asterisk-Addons before 1.2.8, and 1.4.x before 1.4.4, allow remote attackers to execute arbitrary SQL commands via the (1) source and (2) destination numbers, and probably (3) SIP URI, when inserting a record."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de inyecci\u00f3n SQL en la funci\u00f3n cdr_addon_mysql en Asterisk-Addons versiones anteriores a 1.2.8 y versiones 1.4.x anteriores a 1.4.4, permiten a atacantes remotos ejecutar comandos SQL arbitrarios por medio de los n\u00fameros (1) de origen y (2) de destino, y probablemente el (3) URI SIP, al insertar un registro."}], "id": "CVE-2007-5488", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": true, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2007-10-17T23:17:00.000", "references": [{"source": "cve@mitre.org", "url": "http://downloads.digium.com/pub/security/AST-2007-023.html"}, {"source": "cve@mitre.org", "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2007-October/066744.html"}, {"source": "cve@mitre.org", "url": "http://osvdb.org/37880"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/27278"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://www.securityfocus.com/bid/26095"}, {"source": "cve@mitre.org", "url": "http://www.securitytracker.com/id?1018824"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/37235"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://downloads.digium.com/pub/security/AST-2007-023.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2007-October/066744.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://osvdb.org/37880"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/27278"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://www.securityfocus.com/bid/26095"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securitytracker.com/id?1018824"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/37235"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "nvd@nist.gov", "type": "Primary"}]}