LiveActive security incident?Get immediate response
CVE Record

CVE-2010-10007: lierdakil click-reminder BaseAction.php db_query sql injection

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in lierdakil click-reminder. It has been rated as critical. This issue affects the function db_query of the file src/backend/include/BaseAction.php. The manipulation leads to sql injection. The identifier of the patch is 41213b660e8eb01b22c8074f06208f59a73ca8dc. It is recommended to apply a patch to fix this issue. The identifier VDB-218465 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

MediumCVSS 5.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2010-10007 is a SQL injection flaw in the unsupported lierdakil click-reminder project. If the application is still deployed, a low-privileged user with adjacent network access could potentially affect confidentiality, integrity, and availability of stored data. Business urgency depends on whether this legacy tool is present.

Executive priority

Prioritize verification first. If click-reminder is not deployed, no action is needed beyond documentation. If it is deployed, plan patching or replacement because the product is unsupported and the flaw affects database trust boundaries.

Technical view

The reported issue affects the db_query function in src/backend/include/BaseAction.php in lierdakil click-reminder. Manipulation of input can lead to SQL injection, mapped to CWE-89. The source bundle identifies patch commit 41213b660e8eb01b22c8074f06208f59a73ca8dc and CVSS 3.1 score 5.5, AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.

Likely exposure

Exposure is likely limited to organizations still running the unsupported click-reminder application. The CVSS vector indicates adjacent network access and low privileges are required. No affected version range or CPE is provided, so inventory confirmation is required.

Exploitation context

The bundle does not show CISA KEV listing or other cited evidence of active exploitation. The flaw is public, has a VulDB entry, and has a referenced patch commit. Treat internet- or internal-network reachable legacy deployments as higher concern.

Researcher notes

Evidence is limited to the CVE record, VulDB references, and a patch commit. No version range, proof of active exploitation, or detailed vendor advisory is included. Avoid broad product assumptions and validate directly against deployed source code.

Mitigation direction

  • Apply the referenced patch commit if click-reminder must remain in use.
  • Replace unsupported click-reminder with a maintained alternative where practical.
  • Restrict access to trusted networks and authenticated users only.
  • Check vendor or project guidance before making unsupported code changes.
  • Review database privileges used by the application for least privilege.

Validation and detection

  • Inventory environments for lierdakil click-reminder deployments.
  • Confirm whether src/backend/include/BaseAction.php includes the referenced patch.
  • Review authentication and network exposure around the application.
  • Check application and database logs for suspicious query errors.
  • Document unsupported software risk and owner decision.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-89: Database access and collection lookup

Injection into data stores can inform collection, data access, and exfiltration detection reviews. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
description · low confidence lookup

Database behavior lookup

The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2010-10007 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
5.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
5.5CVSS 3.1MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L2.13.4Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

5.5Medium
CVSS 3.1 vector shape for CVE-2010-10007Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
lierdakilclick-remindern/aListed
Weakness

CWE details

CWE-89

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.