Directory Traversal Vulnerability in SQL-Ledger and LedgerSMB
CVE-2007-1540

Currently unrated

Key Information:

Vendor: Sql-ledger
Status: Sql-ledger; Ledgersmb
Vendor: CVE Published:; 20 March 2007

What is CVE-2007-1540?

A directory traversal vulnerability exists in the am.pl script used by SQL-Ledger and LedgerSMB, which could allow remote attackers to execute arbitrary commands and bypass authentication. This vulnerability involves the misuse of dot dot (..) sequences in the login parameter, potentially enabling unauthorized access and manipulation of system files. Although reported fixes have been applied, third-party researchers have indicated that the issue may persist, allowing attackers to exploit the vulnerability despite error messages.