CVE-2005-3918

Multiple SQL injection vulnerabilities in OvBB 0.08a allow remote attackers to execute arbitrary SQL commands via the (1) threadid parameter to thread.php and (2) userid parameter to profile.php. NOTE: the vendor disputes these issues, saying "these reports are completely unsubstantial.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://pridels0.blogspot.com/2005/11/ovbb-sql-vulnerabilities.html
http://www.osvdb.org/21307
http://www.osvdb.org/21308
http://www.securityfocus.com/bid/15566	Exploit

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ovbb:ovbb:0.1a:::::::*
	cpe:2.3:a:ovbb:ovbb:0.2a:::::::*
	cpe:2.3:a:ovbb:ovbb:0.3a:::::::*
	cpe:2.3:a:ovbb:ovbb:0.4a:::::::*
	cpe:2.3:a:ovbb:ovbb:0.5a:::::::*
	cpe:2.3:a:ovbb:ovbb:0.6a:::::::*
	cpe:2.3:a:ovbb:ovbb:0.7a:::::::*
	cpe:2.3:a:ovbb:ovbb:0.8a:::::::*

History

07 Nov 2023, 01:57

Type	Values Removed	Values Added
Summary	DISPUTED Multiple SQL injection vulnerabilities in OvBB 0.08a allow remote attackers to execute arbitrary SQL commands via the (1) threadid parameter to thread.php and (2) userid parameter to profile.php. NOTE: the vendor disputes these issues, saying "these reports are completely unsubstantial."	Multiple SQL injection vulnerabilities in OvBB 0.08a allow remote attackers to execute arbitrary SQL commands via the (1) threadid parameter to thread.php and (2) userid parameter to profile.php. NOTE: the vendor disputes these issues, saying "these reports are completely unsubstantial.

Information

Published : 2005-11-30 11:03

Updated : 2024-08-08 00:15

NVD link : CVE-2005-3918

Mitre link : CVE-2005-3918

CVE.ORG link : CVE-2005-3918

JSON object : View

Products Affected

ovbb

ovbb

CWE

NVD-CWE-Other

{"id": "CVE-2005-3918", "cveTags": [{"tags": ["disputed"], "sourceIdentifier": "cve@mitre.org"}], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}]}, "published": "2005-11-30T11:03:00.000", "references": [{"url": "http://pridels0.blogspot.com/2005/11/ovbb-sql-vulnerabilities.html", "source": "cve@mitre.org"}, {"url": "http://www.osvdb.org/21307", "source": "cve@mitre.org"}, {"url": "http://www.osvdb.org/21308", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/15566", "tags": ["Exploit"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Multiple SQL injection vulnerabilities in OvBB 0.08a allow remote attackers to execute arbitrary SQL commands via the (1) threadid parameter to thread.php and (2) userid parameter to profile.php. NOTE: the vendor disputes these issues, saying \"these reports are completely unsubstantial."}], "lastModified": "2024-08-08T00:15:28.817", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ovbb:ovbb:0.1a:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7642CC49-27AA-400C-BEA0-8B27D534B749"}, {"criteria": "cpe:2.3:a:ovbb:ovbb:0.2a:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "86AD1A28-B154-4C21-96A8-E082D9E35325"}, {"criteria": "cpe:2.3:a:ovbb:ovbb:0.3a:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "88378ED4-C03A-4EC1-B767-FFD3CD3E1BF5"}, {"criteria": "cpe:2.3:a:ovbb:ovbb:0.4a:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B3622831-22AA-47CA-AA30-C68EF8F864F9"}, {"criteria": "cpe:2.3:a:ovbb:ovbb:0.5a:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AB197377-19DB-4646-9CB1-1F2F26F8EBE2"}, {"criteria": "cpe:2.3:a:ovbb:ovbb:0.6a:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2D8AFA25-13E3-4115-9C08-26770761498A"}, {"criteria": "cpe:2.3:a:ovbb:ovbb:0.7a:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E7A11444-0088-41E6-AF91-D779C26DC288"}, {"criteria": "cpe:2.3:a:ovbb:ovbb:0.8a:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B8B4E3AD-D481-4892-88D3-4E1E28758E5F"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}