CVE-2005-3682 - Multiple SQL injection vulnerabilities in Wizz Forum 1.20 allow remote attackers to execute arbitrar

CVE-2005-3682

Summary

Multiple SQL injection vulnerabilities in Wizz Forum 1.20 allow remote attackers to execute arbitrary SQL commands via (1) the AuthID parameter in ForumAuthDetails.php, and the TopicID parameter in (2) ForumTopicDetails.php and (3) ForumReply.php.

References

http://marc.info/?l=bugtraq&m=113201564319843&w=2
http://secunia.com/advisories/17548/
http://securityreason.com/securityalert/181
http://www.osvdb.org/20845
http://www.osvdb.org/20846
http://www.osvdb.org/20847
http://www.securityfocus.com/bid/15410/references
http://www.vupen.com/english/advisories/2005/2421
https://exchange.xforce.ibmcloud.com/vulnerabilities/23170
https://exchange.xforce.ibmcloud.com/vulnerabilities/23171

Vulnerable Configurations

cpe:2.3:a:wizz_forum:wizz_forum:1.20:*:*:*:*:*:*:*
cpe:2.3:a:wizz_forum:wizz_forum:1.20:*:*:*:*:*:*:*

CVSS

Base:	7.5 (as of 11-07-2017 - 01:33)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:L/Au:N/C:P/I:P/A:P

refmap via4

bid	15410
bugtraq	20051112 Multible Sql injections in Wizz Forum
osvdb	20845 20846 20847
secunia	17548
sreason	181
vupen	ADV-2005-2421
xf	wizz-forumauthdetails-sql-injection(23170) wizz-topicid-sql-injection(23171)

Last major update

11-07-2017 - 01:33

Published

18-11-2005 - 23:03

Last modified

11-07-2017 - 01:33