Multiple SQL injection vulnerabilities in Ripe Website Manager 0.8.9 and earlier allow…
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- —
- Confidentiality · integrity · availability
- Partial · Partial · Partial
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA.
Summary
Multiple SQL injection vulnerabilities in Ripe Website Manager 0.8.9 and earlier allow remote authenticated users to execute arbitrary SQL commands via one or more of the following vectors: the (1) id parameter to (a) pages/delete_page.php, (b) navigation/delete_menu.php, and (c) navigation/delete_item.php in admin/; the (2) menu_id, (3) name, (3) page_id, and (4) url parameters in (d) admin/navigation/do_new_item.php; the (5) new_menuname parameter in (e) admin/navigation/do_new_nav.php; and (6) area1, name, and url parameters to (f) admin/pages/do_new_page.php. NOTE: some vectors might be reachable through the url and name parameters to (g) admin/navigation/new_nav_item.php. NOTE: the original disclosure does not precisely state which vectors are associated with SQL injection versus XSS.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ripe_website_manager:ripe_website_manager:0.8.4:*:*:*:*:*:*:* | 0.8.4 | Vulnerable | Ripe Website Manager |
| cpe:2.3:a:ripe_website_manager:ripe_website_manager:0.8.9:*:*:*:*:*:*:* | 0.8.9 | Vulnerable | Ripe Website Manager |
- cpe:2.3:a:ripe_website_manager:ripe_website_manager:0.8.4:*:*:*:*:*:*:* Versions 0.8.4 Vulnerable ·Ripe Website Manager
- cpe:2.3:a:ripe_website_manager:ripe_website_manager:0.8.9:*:*:*:*:*:*:* Versions 0.8.9 Vulnerable ·Ripe Website Manager
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2007-4522
- 2026-10-03 Alias added: GHSA-fh44-j3pc-3p3h
References
Advisory 1
More Ripe Website Manager vulnerabilities
- TI-2007-03417 Multiple PHP remote file inclusion vulnerabilities in Ripe Website Manager 0.8.9 and… CVSS 2.0MEDIUM 6.8
- TI-2007-03418 Ripe Website Manager 0.8.9 and earlier allows remote attackers to obtain configuration… CVSS 2.0HIGH 7.8
- TI-2007-02128 SQL injection vulnerability in contact/index.php in Ripe Website Manager 0.8.4 and… CVSS 2.0HIGH 7.5
- TI-2007-02127 Cross-site scripting (XSS) vulnerability in contact/index.php in Ripe Website Manager… CVSS 2.0MEDIUM 4.3
- TI-2007-04378 Multiple cross-site scripting (XSS) vulnerabilities in Ripe Website Manager 0.8.9 and… CVSS 2.0LOW 3.5
Sources
- CVE-2007-4522 · CVE Program
- CVE-2007-4522 · NVD
- FIRST EPSS
- GHSA-fh44-j3pc-3p3h · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences