CVE-2005-3968

SQL injection vulnerability in auth.inc.php in PHPX 3.5.9 and earlier allows remote attackers to execute arbitrary SQL commands, bypass authentication, and upload arbitrary PHP code via the username parameter.

Published Bycve@mitre.org

Published DateDec 03, 2005, 19:03

Weakness Type (CWE):NVD-CWE-Other

CVSS Metrics

Base Score

7.5

Vector String

AV:N/AC:L/Au:N/C:P/I:P/A:P

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

PARTIAL

Integrity (I)

PARTIAL

Availability (A)

PARTIAL

References

http://rgod.altervista.org/phpx_359_xpl.html
http://secunia.com/advisories/17858
http://securitytracker.com/id?1015300
http://www.osvdb.org/21384
http://www.phpx.org/news.php?news_id=139
http://www.securityfocus.com/archive/1/418253/100/0/threaded
http://www.securityfocus.com/bid/15680
http://www.vupen.com/english/advisories/2005/2696
https://exchange.xforce.ibmcloud.com/vulnerabilities/23459

Weakness Type (CWE):NVD-CWE-Other

CVSS Metrics

Base Score

7.5

Vector String

AV:N/AC:L/Au:N/C:P/I:P/A:P

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

PARTIAL

Integrity (I)

PARTIAL

Availability (A)

PARTIAL