CVE-2005-4619

SQL injection vulnerability in index.php in phpoutsourcing Zorum Forum 3.5 and earlier allows remote attackers to execute arbitrary SQL commands via the rollid parameter in the showhtmllist method.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://pridels0.blogspot.com/2005/11/zorum-forum-35-rollid-sql-inj-vuln.html
http://www.osvdb.org/21372	Exploit
http://www.securityfocus.com/bid/16131	Exploit

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:phpoutsourcing:zorum:3.0:::::::*
	cpe:2.3:a:phpoutsourcing:zorum:3.1:::::::*
	cpe:2.3:a:phpoutsourcing:zorum:3.2:::::::*
	cpe:2.3:a:phpoutsourcing:zorum:3.3:::::::*
	cpe:2.3:a:phpoutsourcing:zorum:3.4:::::::*
	cpe:2.3:a:phpoutsourcing:zorum:3.5:::::::*

History

No history.

Information

Published : 2005-12-31 05:00

Updated : 2008-09-20 04:43

NVD link : CVE-2005-4619

Mitre link : CVE-2005-4619

CVE.ORG link : CVE-2005-4619

JSON object : View

Products Affected

phpoutsourcing

zorum

CWE

NVD-CWE-Other

{"id": "CVE-2005-4619", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}]}, "published": "2005-12-31T05:00:00.000", "references": [{"url": "http://pridels0.blogspot.com/2005/11/zorum-forum-35-rollid-sql-inj-vuln.html", "source": "cve@mitre.org"}, {"url": "http://www.osvdb.org/21372", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/16131", "tags": ["Exploit"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "SQL injection vulnerability in index.php in phpoutsourcing Zorum Forum 3.5 and earlier allows remote attackers to execute arbitrary SQL commands via the rollid parameter in the showhtmllist method."}], "lastModified": "2008-09-20T04:43:34.657", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:phpoutsourcing:zorum:3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5C2D033F-18B3-49C1-9EF3-347685F12E83"}, {"criteria": "cpe:2.3:a:phpoutsourcing:zorum:3.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "70AE9137-3FC1-4B5A-B460-D46DF8E041B9"}, {"criteria": "cpe:2.3:a:phpoutsourcing:zorum:3.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "907D1B87-2347-4B70-A045-0DDF93662A07"}, {"criteria": "cpe:2.3:a:phpoutsourcing:zorum:3.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ACB559F1-D8A6-4265-963C-1265FC7997A4"}, {"criteria": "cpe:2.3:a:phpoutsourcing:zorum:3.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EEE0A89A-6DB5-482F-985C-C314DC4D5E28"}, {"criteria": "cpe:2.3:a:phpoutsourcing:zorum:3.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D7D1D438-86A5-4224-852F-EC1E5DB83DC4"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}