CVE-2005-1384

Multiple SQL injection vulnerabilities in phpCoin 1.2.2 allow remote attackers to execute arbitrary SQL commands via the (1) search parameter to index.php, (2) phpcoinsessid parameter to login.php, (3) id, (4) dtopic_id, or (5) dcat_id to mod.php.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://digitalparadox.org/viewadvisories.ah?view=36	Exploit Vendor Advisory
http://marc.info/?l=bugtraq&m=111473522804665&w=2
http://pridels0.blogspot.com/2006/03/phpcoin-poc.html
http://securitytracker.com/id?1013834
http://www.securityfocus.com/bid/13433	Exploit
http://www.vupen.com/english/advisories/2005/0423
https://exchange.xforce.ibmcloud.com/vulnerabilities/20308

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:coinsoft_technologies:phpcoin:1.2:::::::*
	cpe:2.3:a:coinsoft_technologies:phpcoin:1.2.1:::::::*
	cpe:2.3:a:coinsoft_technologies:phpcoin:1.2.1b:::::::*

History

No history.

Information

Published : 2005-05-03 04:00

Updated : 2024-02-28 10:42

NVD link : CVE-2005-1384

Mitre link : CVE-2005-1384

CVE.ORG link : CVE-2005-1384

JSON object : View

Products Affected

coinsoft_technologies

phpcoin

CWE

NVD-CWE-Other

{"id": "CVE-2005-1384", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}]}, "published": "2005-05-03T04:00:00.000", "references": [{"url": "http://digitalparadox.org/viewadvisories.ah?view=36", "tags": ["Exploit", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://marc.info/?l=bugtraq&m=111473522804665&w=2", "source": "cve@mitre.org"}, {"url": "http://pridels0.blogspot.com/2006/03/phpcoin-poc.html", "source": "cve@mitre.org"}, {"url": "http://securitytracker.com/id?1013834", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/13433", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2005/0423", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/20308", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Multiple SQL injection vulnerabilities in phpCoin 1.2.2 allow remote attackers to execute arbitrary SQL commands via the (1) search parameter to index.php, (2) phpcoinsessid parameter to login.php, (3) id, (4) dtopic_id, or (5) dcat_id to mod.php."}], "lastModified": "2017-07-11T01:32:38.077", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:coinsoft_technologies:phpcoin:1.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "14FDCCE7-B76F-42EA-BD82-11D35AAED66E"}, {"criteria": "cpe:2.3:a:coinsoft_technologies:phpcoin:1.2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C84AC0DD-109D-4E44-9673-668238545F05"}, {"criteria": "cpe:2.3:a:coinsoft_technologies:phpcoin:1.2.1b:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8FECE4E8-3258-48E7-8F3A-F564512442CC"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}