CVE-2007-1811

CVE-2007-1811 describes a SQL injection vulnerability in the Tiny Event (tinyevent) module, version 1.01 and earlier, for the Xoops content management system. This flaw allows unauthenticated remote attackers to execute arbitrary SQL commands by manipulating the 'id' parameter within a 'show' action in the index.php file. The vulnerability carries a CVSS score of 7.5, indicating high severity due to its network-based attack vector, low attack complexity, and potential for partial compromise of confidentiality, integrity, and availability. This means an attacker can exploit it remotely without authentication and with minimal effort. While not listed on the KEV catalog or Hot List, and showing no active exploitation or significant community discussion, an exploit for this vulnerability is publicly available on ExploitDB (EDB-3625). This suggests that while not widely discussed, the means to exploit this flaw exist and could be leveraged by malicious actors.