CVE-2005-3364 - Multiple SQL injection vulnerabilities in DboardGear allow remote attackers to execute arbitrary SQL

CVE-2005-3364

Summary

Multiple SQL injection vulnerabilities in DboardGear allow remote attackers to execute arbitrary SQL commands via (1) the buddy parameter in buddy.php, (2) the u2uid parameter in u2u.php, and (3) an invalid theme file in the themes action to ctrtools.php.

References

http://marc.info/?l=bugtraq&m=113017087231116&w=2
http://securityreason.com/securityalert/109
http://securitytracker.com/id?1015095
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2005-10/0298.html
http://www.osvdb.org/20442
http://www.osvdb.org/20443
http://www.securityfocus.com/bid/15174
http://www.securityfocus.com/bid/15194

Vulnerable Configurations

cpe:2.3:a:platinum:dboardgear:*:*:*:*:*:*:*:*
cpe:2.3:a:platinum:dboardgear:*:*:*:*:*:*:*:*

CVSS

Base:	7.5 (as of 18-10-2016 - 03:34)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:L/Au:N/C:P/I:P/A:P

refmap via4

bid	15174 15194
bugtraq	20051024 DBoardGear SQL Injection 20051025 DboardGear - uncorrect import themes (SQL-inject)
osvdb	20442 20443
sectrack	1015095
sreason	109

Last major update

18-10-2016 - 03:34

Published

30-10-2005 - 14:34

Last modified

18-10-2016 - 03:34