Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

TCExam allows attackers to run unauthorized database commands

CVE-2007-6288 · published 18 years ago
Summary

TCExam versions before 5.1.000 can be tricked into executing harmful commands in its database. This could let an attacker view, change, or delete data. Upgrade to the latest version of TCExam or apply the vendor's security patch as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
tecnick.com tcexam <= 5.1.000
cpe:2.3:a:tecnick.com:tcexam:*:*:*:*:*:*:*:*
Original advisory text
Multiple SQL injection vulnerabilities in TCExam before 5.1.000 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
Multiple SQL injection vulnerabilities in TCExam before 5.1.000 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
1% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published10 Dec 2007
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2007-6288 · NVD
Track software like this
Free during beta