$ cve CVE-2007-3814 JSON

CVE-2007-3814 EXPLOIT

7.5

HIGH · CVSS 2.0 · EPSS 2.1% (pctl 81)

Patch early

A public exploit exists.

Description

Multiple SQL injection vulnerabilities in MKPortal 1.1.1 allow remote attackers to execute arbitrary SQL commands via (1) the idurlo field in the delete_urlo function in (a) index.php in the urlobox module; the iden field in the (2) update_file and (3) del_file functions in (b) index.php in the reviews module; the (4) idnews field in the delete_news function and the (5) idcomm field in the del_comment function in (c) index.php in the news module; the (6) idcomm field in the delete_comments function in (d) index.php in the gallery module; the iden field in the (7) edit_file, (8) update_file, and (9) del_file functions in index.php in the gallery module; the (10) ide and (11) cat fields in the slide_update function in index.php in the gallery module; the iden field in the (12) update_file and (13) del_file functions in (d) index.php in the downloads module; and other unspecified vectors.

Scoring

CVSS	7.5 (HIGH, v2.0)
Vector	AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS	2.13% — more likely to be exploited than 81% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2007-07-17
Last modified	2026-06-16

Affected (1)

Vendor	Product
mkportal	mkportal

Public exploits

Source	Title	Date
exploit-db	MKPortal 1.1.1 reviews / Gallery modules - SQL Injection	2007-07-12

References

→ the Explorer · watch your stack · NVD