CVE-2005-4049

Multiple SQL injection vulnerabilities in Blog System 1.2 allow remote attackers to execute arbitrary SQL commands via (1) the cat parameter in index.php and (2) the note parameter in blog.php.

Published Bycve@mitre.org

Published DateDec 07, 2005, 11:03

Weakness Type (CWE):NVD-CWE-Other

CVSS Metrics

Base Score

7.5

Vector String

AV:N/AC:L/Au:N/C:P/I:P/A:P

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

PARTIAL

Integrity (I)

PARTIAL

Availability (A)

PARTIAL

References

http://pridels0.blogspot.com/2005/12/blog-system-v12-sql-inj-vuln.html
http://secunia.com/advisories/17893/
http://securityreason.com/securityalert/230
http://securitytracker.com/id?1015310
http://www.osvdb.org/21453
http://www.osvdb.org/21454
http://www.securityfocus.com/archive/1/418640/100/0/threaded
http://www.securityfocus.com/bid/15719/
http://www.vupen.com/english/advisories/2005/2767
https://exchange.xforce.ibmcloud.com/vulnerabilities/23430

Weakness Type (CWE):NVD-CWE-Other

CVSS Metrics

Base Score

7.5

Vector String

AV:N/AC:L/Au:N/C:P/I:P/A:P

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

PARTIAL

Integrity (I)

PARTIAL

Availability (A)

PARTIAL