CVE Feed

    Dashboard / CVE / CVE-2007-1540

    CVE-2007-1540

    Directory traversal vulnerability in am.pl in (1) SQL-Ledger 2.6.27 and earlier, and (2) LedgerSMB before 1.2.0, allows remote attackers to run arbitrary executables and bypass authentication via a .. (dot dot) sequence and trailing NULL (%00) in the login parameter. NOTE: this issue was reportedly addressed in SQL-Ledger 2.6.27, however third-party researchers claim that the file is still executed even though an error is generated.

    Published:Mar 20, 2007
    Last Modified:Apr 23, 2026
    EPS:Mar 20, 2007
    EPSS Score:0.08245
    CVSS Score:4.3

    Affected Products

    Vendor
    Ledgersmb
    Product
    Ledgersmb
    Vendor
    Sql-ledger
    Product
    Sql-ledger

    Exploits

    https://www.exploit-db.com/exploits/29761

    Common Weakness Enumeration

    No CWE recorded yet

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2024-23831 (CVSS 7.5) — LedgerSMB is a free web-based double-entry accounting system. When a LedgerSMB database administrator has an a…
    CVE-2021-3882 (CVSS 6.8) — LedgerSMB does not set the 'Secure' attribute on the session authorization cookie when the client uses HTTPS a…
    CVE-2021-3731 (CVSS 5.9) — LedgerSMB does not sufficiently guard against being wrapped by other sites, making it vulnerable to 'clickjack…
    CVE-2021-3694 (CVSS 8.2) — LedgerSMB does not sufficiently HTML-encode error messages sent to the browser. By sending a specially crafted…
    CVE-2021-3693 (CVSS 8.8) — LedgerSMB does not check the origin of HTML fragments merged into the browser's DOM. By sending a specially cr…
    CVE-2018-9246 (CVSS 9.8) — The PGObject::Util::DBAdmin module before 0.120.0 for Perl, as used in LedgerSMB through 1.5.x, insufficiently…
    CVE-2008-4077 (CVSS 7.8) — The CGI scripts in (1) LedgerSMB (LSMB) before 1.2.15 and (2) SQL-Ledger 2.8.17 and earlier allow remote attac…
    CVE-2008-4078 (CVSS 6.5) — SQL injection vulnerability in the AR/AP transaction report in (1) LedgerSMB (LSMB) before 1.2.15 and (2) SQL-…
    CVE-2007-5372 (CVSS 10) — Multiple SQL injection vulnerabilities in (a) LedgerSMB 1.0.0 through 1.2.7 and (b) DWS Systems SQL-Ledger 2.x…
    CVE-2007-3907 (CVSS 10) — Unspecified vulnerability in login.pl in LedgerSMB 1.2.0 through 1.2.6 allows remote attackers to bypass authe…

    References

    http://secunia.com/advisories/24560
    http://secunia.com/advisories/24585
    http://sourceforge.net/project/shownotes.php?release_id=494462&group_id=175965
    http://sql-ledger.com/cgi-bin/nav.pl?page=news.html&title=What%27s%20New
    http://www.osvdb.org/33624
    http://www.securityfocus.com/archive/1/463175/100/0/threaded
    http://www.securityfocus.com/bid/23034
    http://www.vupen.com/english/advisories/2007/1024
    http://www.vupen.com/english/advisories/2007/1025
    http://secunia.com/advisories/24560
    http://secunia.com/advisories/24585
    http://sourceforge.net/project/shownotes.php?release_id=494462&group_id=175965
    http://sql-ledger.com/cgi-bin/nav.pl?page=news.html&title=What%27s%20New
    http://www.osvdb.org/33624
    http://www.securityfocus.com/archive/1/463175/100/0/threaded
    http://www.securityfocus.com/bid/23034
    http://www.vupen.com/english/advisories/2007/1024
    http://www.vupen.com/english/advisories/2007/1025

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High