CVE-2005-0413

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

• MyPHP Forum 1.0 - SQL Injection2005-02-10 · webapps · php · Verified

Impact

Multiple SQL injection vulnerabilities in MyPHP Forum 1.0 allow remote attackers to execute arbitrary SQL commands via (1) the fid in forum.php, (2) the member parameter in member.php, (3) the email parameter in forgot.php, or (4) the nbuser or nbpass parameters in include.php. NOTE: it was later reported that vector 2 exists in 3.0 and earlier.

Affected products

Weakness classification

References

• NVD record
• CVE.org record
• http://seclists.org/lists/bugtraq/2005/Feb/0125.html
• http://secunia.com/advisories/14205
• http://securitytracker.com/id?1013136
• http://www.securityfocus.com/bid/12501
• http://www.securityfocus.com/bid/27083
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19272
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39348
• https://www.exploit-db.com/exploits/4822
• http://seclists.org/lists/bugtraq/2005/Feb/0125.html
• http://secunia.com/advisories/14205
• http://securitytracker.com/id?1013136
• http://www.securityfocus.com/bid/12501
• http://www.securityfocus.com/bid/27083
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19272
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39348
• https://www.exploit-db.com/exploits/4822