CVE-2005-2383

SQL injection vulnerability in auth.php in PHPNews 1.2.5 allows remote attackers to execute arbitrary SQL commands via the user parameter in an HTTP POST request.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://marc.info/?l=bugtraq&m=112189453304389&w=2
http://newsphp.sourceforge.net/changelog/changelog_1.30.txt	Patch
http://secunia.com/advisories/16148
http://www.securityfocus.com/bid/14333
http://marc.info/?l=bugtraq&m=112189453304389&w=2
http://newsphp.sourceforge.net/changelog/changelog_1.30.txt	Patch
http://secunia.com/advisories/16148
http://www.securityfocus.com/bid/14333

Configurations

Configuration 1 (hide)

cpe:2.3:a:phpnews:phpnews:1.2.5:*:*:*:*:*:*:*

History

20 Nov 2024, 23:59

Type	Values Removed	Values Added
References	~~() http://marc.info/?l=bugtraq&m=112189453304389&w=2 -~~	() http://marc.info/?l=bugtraq&m=112189453304389&w=2 -
References	~~() http://newsphp.sourceforge.net/changelog/changelog_1.30.txt - Patch~~	() http://newsphp.sourceforge.net/changelog/changelog_1.30.txt - Patch
References	~~() http://secunia.com/advisories/16148 -~~	() http://secunia.com/advisories/16148 -
References	~~() http://www.securityfocus.com/bid/14333 -~~	() http://www.securityfocus.com/bid/14333 -

Information

Published : 2005-07-26 04:00

Updated : 2024-11-20 23:59

NVD link : CVE-2005-2383

Mitre link : CVE-2005-2383

CVE.ORG link : CVE-2005-2383

JSON object : View

Products Affected

phpnews

phpnews

CWE

NVD-CWE-Other

{"id": "CVE-2005-2383", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}]}, "published": "2005-07-26T04:00:00.000", "references": [{"url": "http://marc.info/?l=bugtraq&m=112189453304389&w=2", "source": "cve@mitre.org"}, {"url": "http://newsphp.sourceforge.net/changelog/changelog_1.30.txt", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/16148", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/14333", "source": "cve@mitre.org"}, {"url": "http://marc.info/?l=bugtraq&m=112189453304389&w=2", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://newsphp.sourceforge.net/changelog/changelog_1.30.txt", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://secunia.com/advisories/16148", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/14333", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "SQL injection vulnerability in auth.php in PHPNews 1.2.5 allows remote attackers to execute arbitrary SQL commands via the user parameter in an HTTP POST request."}, {"lang": "es", "value": "Vulnerabilidad de inyecci\u00f3n de SQL en auth.php en PHPNews 1.2.5 permite que atacantes remotos ejecuten comandos SQL arbitrarios mediante el par\u00e1metro \"user\" en una petici\u00f3n HTTP POST."}], "lastModified": "2024-11-20T23:59:25.807", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:phpnews:phpnews:1.2.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2B158F9B-3EB3-4714-8806-39EAA8ACE28F"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}