CVE-2005-2000

Multiple SQL injection vulnerabilities in paFileDB 3.1 and earlier allow remote attackers to execute arbitrary SQL commands via the formname parameter (1) in the login form, (2) in the team login form, or (3) to auth.php, (4) select, (5) id, or (6) query parameter to pafiledb.php, or (7) string parameter to search.php.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://marc.info/?l=bugtraq&m=111885787217807&w=2
http://www.gulftech.org/?node=research&article_id=00082-06142005	Exploit Patch
http://www.phparena.net/	Patch
http://www.phparena.net/pafiledb_patch/	Patch

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:php_arena:pafiledb:1.1.3:::::::*
	cpe:2.3:a:php_arena:pafiledb:2.1.1:::::::*
	cpe:2.3:a:php_arena:pafiledb:3.0:::::::*
	cpe:2.3:a:php_arena:pafiledb:3.0_beta_3.1:::::::*
	cpe:2.3:a:php_arena:pafiledb:3.1:::::::*

History

No history.

Information

Published : 2005-06-15 04:00

Updated : 2024-02-28 10:42

NVD link : CVE-2005-2000

Mitre link : CVE-2005-2000

CVE.ORG link : CVE-2005-2000

JSON object : View

Products Affected

php_arena

pafiledb

CWE

NVD-CWE-Other

{"id": "CVE-2005-2000", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}]}, "published": "2005-06-15T04:00:00.000", "references": [{"url": "http://marc.info/?l=bugtraq&m=111885787217807&w=2", "source": "cve@mitre.org"}, {"url": "http://www.gulftech.org/?node=research&article_id=00082-06142005", "tags": ["Exploit", "Patch"], "source": "cve@mitre.org"}, {"url": "http://www.phparena.net/", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "http://www.phparena.net/pafiledb_patch/", "tags": ["Patch"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Multiple SQL injection vulnerabilities in paFileDB 3.1 and earlier allow remote attackers to execute arbitrary SQL commands via the formname parameter (1) in the login form, (2) in the team login form, or (3) to auth.php, (4) select, (5) id, or (6) query parameter to pafiledb.php, or (7) string parameter to search.php."}], "lastModified": "2016-10-18T03:23:52.830", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:php_arena:pafiledb:1.1.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "12BADFC3-51C0-4881-B5DF-81BBA02F0EAD"}, {"criteria": "cpe:2.3:a:php_arena:pafiledb:2.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EF4CCDF7-5945-4478-9661-217F823DE9F0"}, {"criteria": "cpe:2.3:a:php_arena:pafiledb:3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DFC5717A-E248-406F-A281-C5B2F5368127"}, {"criteria": "cpe:2.3:a:php_arena:pafiledb:3.0_beta_3.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2E807335-6C70-4A19-A692-A7DE325FC213"}, {"criteria": "cpe:2.3:a:php_arena:pafiledb:3.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E6EB588E-FC2B-4E10-86F5-33C2758BEED5"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}