Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

phpMyQuote 0.20 lets attackers change data via edit page

CVE-2007-4835 · published 19 years ago
Summary

The edit function in phpMyQuote version 0.20 does not check the information it receives, so a remote user can send specially crafted input and cause the system to run unintended database commands. This could let an attacker view, modify, or delete stored quotes and other data. Apply the vendor's update or patch and restrict access to the edit page until the fix is in place.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
phpmyquote phpmyquote 0.20
cpe:2.3:a:phpmyquote:phpmyquote:0.20:*:*:*:*:*:*:*
Original advisory text
SQL injection vulnerability in index.php in phpMyQuote 0.20 allows remote attackers to execute arbitrary SQL commands via the id parameter in an edit action.
SQL injection vulnerability in index.php in phpMyQuote 0.20 allows remote attackers to execute arbitrary SQL commands via the id parameter in an edit action.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
1% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published12 Sep 2007
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2007-4835 · NVD
Track software like this
Free during beta