{"id":"CVE-2007-2305","aliases":["EUVD-2007-2300","GHSA-97jg-4x8h-53r4"],"status":"published","title":"Multiple SQL injection vulnerabilities in authenticate.php in Quick and Dirty Blog (QDBlog) 0.4,...","description":"Multiple SQL injection vulnerabilities in authenticate.php in Quick and Dirty Blog (QDBlog) 0.4, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01041,"percentile":0.64238,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"published":"2007-04-26T21:00:00Z","modified":"2026-06-16T22:39:19Z","exploits":[{"source":"exploitdb","id":"EDB-3729","title":"Quick and Dirty Blog (qdblog) 0.4 - SQL Injection / Local File Inclusion","type":"webapps","platform":"php","date":"2007-04-13","verified":true,"url":"https://www.exploit-db.com/exploits/3729"}],"products":[{"vendor":"qdblog","product":"qdblog"}],"references":[{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/33631","tags":["vdb-entry","x_refsource_XF","x_transferred"]},{"url":"http://www.vupen.com/english/advisories/2007/1387","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"]},{"url":"https://www.exploit-db.com/exploits/3729","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"]},{"url":"http://www.securityfocus.com/bid/23485","tags":["vdb-entry","x_refsource_BID","x_transferred","Exploit"]},{"url":"http://osvdb.org/35746","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-2305"},{"url":"https://github.com/advisories/GHSA-97jg-4x8h-53r4"}],"sources":{"cve":[{"id":"CVE-2007-2305","description":"Multiple SQL injection vulnerabilities in authenticate.php in Quick and Dirty Blog (QDBlog) 0.4, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.","status":"published","published":"2007-04-26T21:00:00Z","modified":"2024-08-07T13:33:28.327Z","updated_at":"2026-11-02T13:32:23.14582Z"}],"euvd":[{"id":"EUVD-2007-2300","description":"Multiple SQL injection vulnerabilities in authenticate.php in Quick and Dirty Blog (QDBlog) 0.4, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.","status":"published","published":"2007-04-26T21:00:00Z","modified":"2024-08-07T13:33:28Z","updated_at":"2026-11-03T01:38:21.874689Z"}],"ghsa":[{"id":"GHSA-97jg-4x8h-53r4","title":"Multiple SQL injection vulnerabilities in authenticate.php in Quick and Dirty Blog (QDBlog) 0.4,...","description":"Multiple SQL injection vulnerabilities in authenticate.php in Quick and Dirty Blog (QDBlog) 0.4, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.","status":"published","published":"2022-05-01T18:02:18Z","modified":"2023-01-31T05:03:33Z","updated_at":"2026-11-02T14:48:29.790939Z"}],"nvd":[{"id":"CVE-2007-2305","description":"Multiple SQL injection vulnerabilities in authenticate.php in Quick and Dirty Blog (QDBlog) 0.4, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.","status":"published","published":"2007-04-26T21:19:00Z","modified":"2026-06-16T22:39:19.943Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:01:15.696607Z"}]}}