CVE-2007-1540

Directory traversal vulnerability in am.pl in (1) SQL-Ledger 2.6.27 and earlier, and (2) LedgerSMB before 1.2.0, allows remote attackers to run arbitrary executables and bypass authentication via a .. (dot dot) sequence and trailing NULL (%00) in the login parameter. NOTE: this issue was reportedly addressed in SQL-Ledger 2.6.27, however third-party researchers claim that the file is still executed even though an error is generated.

• http://secunia.com/advisories/24560
• http://secunia.com/advisories/24585
• http://sourceforge.net/project/shownotes.php?release_id=494462&group_id=175965Patch
• http://sql-ledger.com/cgi-bin/nav.pl?page=news.html&title=What%27s%20New
• http://www.osvdb.org/33624
• http://www.securityfocus.com/archive/1/463175/100/0/threaded
• http://www.securityfocus.com/bid/23034
• http://www.vupen.com/english/advisories/2007/1024
• http://www.vupen.com/english/advisories/2007/1025
• http://secunia.com/advisories/24560
• http://secunia.com/advisories/24585
• http://sourceforge.net/project/shownotes.php?release_id=494462&group_id=175965Patch
• http://sql-ledger.com/cgi-bin/nav.pl?page=news.html&title=What%27s%20New
• http://www.osvdb.org/33624
• http://www.securityfocus.com/archive/1/463175/100/0/threaded
• http://www.securityfocus.com/bid/23034
• http://www.vupen.com/english/advisories/2007/1024
• http://www.vupen.com/english/advisories/2007/1025

Published

Mar 20, 2007

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2007-1534DFSR.exe in Windows Meeting Space in Microsoft Windows Vista…
• CVE-2007-1535Microsoft Windows Vista establishes a Teredo address without…
• CVE-2007-1536Integer underflow in the file_printf function in the "file" …
• CVE-2007-1537\Device\NdisTapi (NDISTAPI.sys) in Microsoft Windows XP SP2 …
• CVE-2007-1538McAfee VirusScan Enterprise 8.5.0.i uses insecure permission…
• CVE-2007-1539Directory traversal vulnerability in inc/map.func.php in pra…
• CVE-2007-1541Directory traversal vulnerability in am.pl in SQL-Ledger 2.6…
• CVE-2007-1542Unspecified vulnerability in the Cisco IP Phone 7940 and 796…
• CVE-2007-1543Stack-based buffer overflow in the accept_att_local function…
• CVE-2007-1544Integer overflow in the ProcAuWriteElement function in serve…
• CVE-2007-1545The AddResource function in server/dia/resource.c in Network…
• CVE-2007-1546Array index error in Network Audio System (NAS) before 1.8a …