7.5

CVE-2005-3365

Exploit
Multiple SQL injection vulnerabilities in DCP-Portal 6 and earlier allow remote attackers to execute arbitrary SQL commands, possibly requiring encoded characters, via (1) the name parameter in register.php, (2) the email parameter in lostpassword.php, (3) the year parameter in calendar.php, and the (4) cid parameter to index.php.  NOTE: the mid parameter for forums.php is already associated with CVE-2005-0454.  NOTE: the index.php/cid vector was later reported to affect 6.11.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.17% 0.863
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

http://glide.stanford.edu/yichen/research/sec.pdf
http://securityreason.com/securityalert/108
http://www.securityfocus.com/archive/1/419280/100/0/threaded
http://marc.info/?l=bugtraq&m=113017151829342&w=2
http://secunia.com/advisories/12751/
Vendor Advisory
Exploit
http://www.osvdb.org/20493
http://www.osvdb.org/20494
http://www.securityfocus.com/bid/15183
Exploit
http://www.securityfocus.com/bid/27167
https://exchange.xforce.ibmcloud.com/vulnerabilities/22855
https://exchange.xforce.ibmcloud.com/vulnerabilities/39447
https://www.exploit-db.com/exploits/4853