CVE-2007-2079

{
  "id": "CVE-2007-2079",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": true,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2007-04-18T03:19:00.000",
  "references": [
    {
      "url": "http://osvdb.org/41594",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/23491",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33683",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.exploit-db.com/exploits/3738",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/41594",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/23491",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33683",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.exploit-db.com/exploits/3738",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The ADONewConnection Connect function in adodb.php in XAMPP 1.6.0a and earlier for Windows uses untrusted input for the database server hostname, which allows remote attackers to trigger a library buffer overflow and execute arbitrary code via a long host parameter, or have other unspecified impact.  NOTE: it could be argued that this is an issue in mssql_connect (CVE-2007-1411.1) in PHP, or an issue in the ADOdb Library, and the proper fix should be in one of these products; if so, then this should not be treated as a vulnerability in XAMPP."
    },
    {
      "lang": "es",
      "value": "La función ADONewConnection Connect en adodb.php de XAMPP 1.6.0a y anteriores para Windows utiliza una entrada que no es de confianza para el nombre de la máquina servidora de base de datos, lo cual permite a atacantes remotos provocar un desbordamiento de búfer de librería y ejecutar código de su elección mediante parámetro host largo, o tener otro impacto desconocido. NOTA: se podría argumentar que este asunto es relativo a mssql_connect (CVE-2007-1411.1) en PHP, o a la librería ADOdb, y la solución adecuada debería estar en uno de estos productos; si así fuera, esta no debería ser tratada como una vulnerabilidad en XAMPP."
    }
  ],
  "lastModified": "2026-06-16T22:38:52.597",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:xampp:apache_distribution:*:*:windows:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ACAB22B5-2307-46EC-ADE3-5974AD96FA52",
              "versionEndIncluding": "1.6.0a"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "evaluatorImpact": "Failed exploit attempts will likely crash the webserver, denying service to legitimate users.  Additionally, this issue is remotely exploitable only if the installation is not secured as described in the manual.",
  "sourceIdentifier": "cve@mitre.org"
}