high7.5Public exploit code
CVE-2005-3877
Multiple SQL injection vulnerabilities in Simple Document Management System (SDMS) 2.0-CVS and earlier allow remote attackers to execute arbitrary SQL commands…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Simple Document Management System 2.0 - 'messages.php?mid' SQL Injection2005-11-28 · webapps · php · Verified
- Simple Document Management System 2.0 - 'list.php?folder_id' SQL Injection2005-11-28 · webapps · php · Verified
Impact
Multiple SQL injection vulnerabilities in Simple Document Management System (SDMS) 2.0-CVS and earlier allow remote attackers to execute arbitrary SQL commands via the (1) folder_id parameter in list.php and (2) mid parameter in a view action to messages.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Cafuego | Simple Document Management System | through 2.0-cvs Versions 1.1.4, 1.1.5, 1.1.6 |
Weakness classification
References
- NVD record
- CVE.org record
- http://pridels0.blogspot.com/2005/11/sdms-20-sql-inj-vuln.html
- http://secunia.com/advisories/17746
- http://www.osvdb.org/21374
- http://www.osvdb.org/21375
- http://www.securityfocus.com/bid/15596
- http://www.vupen.com/english/advisories/2005/2614
- http://pridels0.blogspot.com/2005/11/sdms-20-sql-inj-vuln.html
- http://secunia.com/advisories/17746
- http://www.osvdb.org/21374
- http://www.osvdb.org/21375
- http://www.securityfocus.com/bid/15596
- http://www.vupen.com/english/advisories/2005/2614