CVEvulnerability
CVE-2005-0413
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2005-04-27
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-89
Description
Multiple SQL injection vulnerabilities in MyPHP Forum 1.0 allow remote attackers to execute arbitrary SQL commands via (1) the fid in forum.php, (2) the member parameter in member.php, (3) the email parameter in forgot.php, or (4) the nbuser or nbpass parameters in include.php. NOTE: it was later reported that vector 2 exists in 3.0 and earlier.
Affected configurations
• myphp forum myphp forum 1.0
• myphp forum myphp forum 2.0
• myphp forum myphp forum 3.0
Related
Weakness · CWE (1)
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness
References
- http://seclists.org/lists/bugtraq/2005/Feb/0125.html Exploit
- http://secunia.com/advisories/14205 Vendor Advisory
- http://securitytracker.com/id?1013136 Exploit, Vendor Advisory
- http://www.securityfocus.com/bid/12501 www.securityfocus.com
- http://www.securityfocus.com/bid/27083 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/19272 exchange.xforce.ibmcloud.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/39348 exchange.xforce.ibmcloud.com
- https://www.exploit-db.com/exploits/4822 www.exploit-db.com
- http://seclists.org/lists/bugtraq/2005/Feb/0125.html Exploit
- http://secunia.com/advisories/14205 Vendor Advisory
- http://securitytracker.com/id?1013136 Exploit, Vendor Advisory
- http://www.securityfocus.com/bid/12501 www.securityfocus.com
- http://www.securityfocus.com/bid/27083 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/19272 exchange.xforce.ibmcloud.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/39348 exchange.xforce.ibmcloud.com
- https://www.exploit-db.com/exploits/4822 www.exploit-db.com