CVE-2007-1974

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

5.53%

Published

Apr 12, 2007

Modified

Jun 16, 2026

Public PoC / Exploit (4)

All weaponized →

Exploit-DBXOOPS Module WF-Section 1.01 - 'articleId' SQL Injection Exploit-DBXOOPS Module XFsection 1.07 - 'articleId' Blind SQL Injection Exploit-DBXOOPS Module Zmagazine 1.0 - 'print.php' SQL Injection TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

SQL injection vulnerability in the getArticle function in class/wfsarticle.php in WF-Section (aka WF-Sections) 1.0.1, as used in Xoops modules such as (1) Zmagazine 1.0, (2) Happy Linux XFsection 1.07 and earlier, and possibly other modules, allows remote attackers to execute arbitrary SQL commands via the articleid parameter to print.php.

Affected Products (3)

wf-sections · wf-sectionsvulnerable

xoops · happy_linux_xfsection_modulevulnerable

xoops · zmagazine_modulevulnerable

References (20)

http://addons.zarilia.com/index.php?page_type=static&id=43

Patch

http://osvdb.org/41387

http://osvdb.org/52230

http://www.attrition.org/pipermail/vim/2007-April/001507.html

Vendor Advisory

http://www.securityfocus.com/archive/1/488317/100/0/threaded