CVE-2007-1540 Path traversal in n/a
Remote attackers can execute arbitrary code and bypass authentication via directory traversal in the login parameter of SQL-Ledger and LedgerSMB.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2007-1540?
CVE-2007-1540 is a medium-severity path traversal vulnerability in n/a, published on 20 Mar 2007. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Directory traversal vulnerability in am.pl in (1) SQL-Ledger 2.6.27 and earlier, and (2) LedgerSMB before 1.2.0, allows remote attackers to run arbitrary executables and bypass authentication via a .. (dot dot) sequence and trailing NULL (%00) in the login parameter. NOTE: this issue was reportedly addressed in SQL-Ledger 2.6.27, however third-party researchers claim that the file is still executed even though an error is generated.
Which versions are affected by CVE-2007-1540?
It affects 2 products.
Products include Ledgersmb Ledgersmb, Sql-Ledger Sql-Ledger.
How do I fix CVE-2007-1540?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2007-1540 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2007-1540 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2007-1540, GHSA-6r5q-24m9-x8j7.