CVE-2005-0669 - Multiple SQL injection vulnerabilities in mod.php for phpCOIN 1.2.0 through 1.2.1b allow remote atta

CVE-2005-0669

Summary

Multiple SQL injection vulnerabilities in mod.php for phpCOIN 1.2.0 through 1.2.1b allow remote attackers to execute arbitrary SQL commands via the (1) the faq_id in the faq mod, (2) the id parameter in the pages mod, (3) the id parameter in the siteinfo module, (4) the topic_id parameter in the articles module, (5) the ord_id in the orders module, (6) the dom_id parameter in the domains module, or (7) the invd_id parameter in the invoices module.

References

Vulnerable Configurations

cpe:2.3:a:coinsoft_technologies:phpcoin:1.2:*:*:*:*:*:*:*
cpe:2.3:a:coinsoft_technologies:phpcoin:1.2:*:*:*:*:*:*:*
cpe:2.3:a:coinsoft_technologies:phpcoin:1.2.1:*:*:*:*:*:*:*
cpe:2.3:a:coinsoft_technologies:phpcoin:1.2.1:*:*:*:*:*:*:*
cpe:2.3:a:coinsoft_technologies:phpcoin:1.2.1b:*:*:*:*:*:*:*
cpe:2.3:a:coinsoft_technologies:phpcoin:1.2.1b:*:*:*:*:*:*:*

CVSS

Base:	7.5 (as of 11-07-2017 - 01:32)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:L/Au:N/C:P/I:P/A:P

refmap via4

bid	12686
confirm	http://forums.phpcoin.com/index.php?showtopic=4101 http://forums.phpcoin.com/index.php?showtopic=4116 http://forums.phpcoin.com/index.php?showtopic=4118
misc	http://lostmon.blogspot.com/2005/03/phpcoin-posible-sql-injection-comands.html
sectrack	1013329
secunia	14439
xf	phpcoin-id-sql-injection(19571)

Last major update

11-07-2017 - 01:32

Published

02-05-2005 - 04:00

Last modified

11-07-2017 - 01:32