Analyst readout for executives and security teams
Plain-English summary
CVE-2007-0984 is a SQL injection issue reported in PollMentor 2.0. A remote attacker could manipulate a polling-related request so the application runs unintended database commands. The sources do not provide CVSS scoring, vendor fix details, or evidence of active exploitation.
Executive priority
Treat this as a legacy web application risk. Prioritize if PollMentor 2.0 is internet-facing or connected to sensitive databases. If the product is absent, no action beyond documentation is needed.
Technical view
The CVE describes SQL injection affecting PollMentor 2.0, involving the id parameter associated with pollmentorres.asp and admin_poll.asp references. Successful abuse may allow arbitrary SQL command execution against the backing database. Public exploit reference exists, but the bundle does not confirm current exploitation or patched versions.
Likely exposure
Exposure is likely limited to legacy ASP sites still running PollMentor 2.0 or preserved copies of its polling endpoints. Structured affected-product metadata is incomplete, so validation should focus on asset discovery rather than product inventory alone.
Exploitation context
The bundle includes an Exploit-DB reference, indicating public exploit information existed. It does not include KEV status, active exploitation evidence, authentication requirements, affected database details, or reliable prevalence data.
Researcher notes
The record is sparse: no CVSS, no CWE, no vendor fix, and incomplete affected metadata. Analysis should not assume modern exploit activity, but public exploit availability and arbitrary SQL impact justify targeted validation.
Mitigation direction
- Check vendor or advisory guidance for any fixed PollMentor release or workaround.
- Remove or disable PollMentor 2.0 if it is no longer supported.
- Restrict access to PollMentor administrative and polling ASP endpoints.
- Apply database least privilege for the application account.
- Monitor relevant ASP endpoints for suspicious parameter activity.
Validation and detection
- Inventory public and internal web servers for PollMentor 2.0.
- Look for admin_poll.asp and pollmentorres.asp in deployed web roots.
- Review logs for unusual requests to those ASP files.
- Confirm whether the id parameter reaches database query logic unsafely.
- Verify compensating controls limit database write and administrative impact.
Public sources used
Based on public source material and reviewed before publication.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Database behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2007-0984 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- 33192CVE reference · vdb-entry, x_refsource_OSVDB
- 24137CVE reference · third-party-advisory, x_refsource_SECUNIA
- pollmentor-pollmentorres-sql-injection(32456)CVE reference · vdb-entry, x_refsource_XF
- ADV-2007-0601CVE reference · vdb-entry, x_refsource_VUPEN
- 3301CVE reference · exploit, x_refsource_EXPLOIT-DB
- 22542CVE reference · vdb-entry, x_refsource_BID
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.