CVE-2007-2672

CVE-2007-2672 describes a SQL injection vulnerability in PHP Coupon Script 3.0, specifically within the index.php file when handling the 'bus' parameter in a 'viewbus' page. This flaw allows unauthenticated remote attackers to execute arbitrary SQL commands, potentially leading to data compromise, modification, or denial of service. With a CVSS score of 7.5, it is considered highly severe due to its network-based attack vector and low attack complexity. While not listed on CISA's KEV catalog, exploit code is publicly available on ExploitDB, though there is no evidence of active exploitation, Metasploit modules, or significant community discussion.