CVE-2005-4427 - Multiple SQL injection vulnerabilities in Cerberus Helpdesk allow remote attackers to execute arbitr

CVE-2005-4427

Summary

Multiple SQL injection vulnerabilities in Cerberus Helpdesk allow remote attackers to execute arbitrary SQL commands via the (1) file_id parameter to attachment_send.php, (2) the $addy variable in email_parser.php, (3) $address variable in email_parser.php, (4) $a_address variable in structs.php, (5) kbid parameter to cer_KnowledgebaseHandler.class.php, (6) queues[] parameter to addresses_export.php, (7) $thread variable to display.php, (8) ticket parameter to display_ticket_thread.php.

References

Vulnerable Configurations

cpe:2.3:a:cerberus:cerberus_helpdesk:2.649:*:*:*:*:*:*:*
cpe:2.3:a:cerberus:cerberus_helpdesk:2.649:*:*:*:*:*:*:*

CVSS

Base:	7.5 (as of 19-10-2018 - 15:40)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:L/Au:N/C:P/I:P/A:P

refmap via4

bid	16062
bugtraq	20051225 Cerberus Helpdesk multiple vulnerabilities.
confirm	http://forum.cerberusweb.com/showthread.php?s=&postid=30315
fulldisc	20051219 Cerberus Helpdesk vulnerabilities
osvdb	21988 21990 21991 21992 21993 21994 21995
secunia	18112
xf	cerberus-multiple-sql-injection(23836)

Last major update

19-10-2018 - 15:40

Published

20-12-2005 - 23:03

Last modified

19-10-2018 - 15:40