$ cve CVE-2007-1974 JSON

CVE-2007-1974 EXPLOIT

7.5

HIGH · CVSS 2.0 · EPSS 5.5% (pctl 93)

Patch early

A public exploit exists.

Description

SQL injection vulnerability in the getArticle function in class/wfsarticle.php in WF-Section (aka WF-Sections) 1.0.1, as used in Xoops modules such as (1) Zmagazine 1.0, (2) Happy Linux XFsection 1.07 and earlier, and possibly other modules, allows remote attackers to execute arbitrary SQL commands via the articleid parameter to print.php.

Scoring

CVSS	7.5 (HIGH, v2.0)
Vector	AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS	5.53% — more likely to be exploited than 93% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2007-04-12
Last modified	2026-06-16

Affected (3)

Vendor	Product
wf-sections	wf-sections
xoops	happy linux xfsection module
xoops	zmagazine module

Public exploits

Source	Title	Date
exploit-db	XOOPS Module WF-Section 1.01 - 'articleId' SQL Injection	2007-04-02
exploit-db	XOOPS Module XFsection 1.07 - 'articleId' Blind SQL Injection	2007-04-02
exploit-db	XOOPS Module Zmagazine 1.0 - 'print.php' SQL Injection	2007-04-02

References

→ the Explorer · watch your stack · NVD