6.8
CVE-2005-3543
- EPSS 1.44%
- Veröffentlicht 16.11.2005 07:42:00
- Zuletzt bearbeitet 16.06.2026 22:17:09
- Erkennungen
LoginSQL injection vulnerability in search.php in Phorum 5.0.0alpha through 5.0.20, when register_globals is enabled, allows remote attackers to execute arbitrary SQL commands via the forum_ids parameter.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 1.44% | 0.697 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 6.8 | 8.6 | 6.4 |
AV:N/AC:M/Au:N/C:P/I:P/A:P
|
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
http://marc.info/?l=bugtraq&m=113122911424216&w=2
http://phorum.org/story.php?57
http://secunia.com/advisories/17456
http://securityreason.com/securityalert/153
http://www.osvdb.org/20524
http://www.vupen.com/english/advisories/2005/2332
http://www.waraxe.us/advisory-43.html