CVE-2005-3363 - SQL injection vulnerability in Saphp Lesson, possibly saphp Lesson1.1 and saphpLesson2.0, allows rem

CVE-2005-3363

Summary

SQL injection vulnerability in Saphp Lesson, possibly saphp Lesson1.1 and saphpLesson2.0, allows remote attackers to execute arbitrary SQL commands via the forumid parameter in (1) showcat.php and (2) add.php.

References

Vulnerable Configurations

cpe:2.3:a:saphp:saphplesson:1.1:*:*:*:*:*:*:*
cpe:2.3:a:saphp:saphplesson:1.1:*:*:*:*:*:*:*
cpe:2.3:a:saphp:saphplesson:2.0:*:*:*:*:*:*:*
cpe:2.3:a:saphp:saphplesson:2.0:*:*:*:*:*:*:*

CVSS

Base:	7.5 (as of 19-10-2018 - 15:36)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:L/Au:N/C:P/I:P/A:P

refmap via4

bid	15185
bugtraq	20051024 SQL saphp Lesson 20060412 SaphpLesson 2.0 (forumid) Remote SQL Injection Exploit 20060711 saphp "add.php" forumid Parameter SQL Injection 20070704 SQL Injection in saphp "showcat.php"
exploit-db	1530
osvdb	20289 20290
secunia	17308
sreason	111
vim	20051029 Saphp Lesson
xf	saphp-add-sql-injection(27746) saphplesson-multiple-sql-injection(22861)

Last major update

19-10-2018 - 15:36

Published

30-10-2005 - 14:34

Last modified

19-10-2018 - 15:36