vulnwire
6.8med

CVE-2005-32362 exploits

Multiple SQL injection vulnerabilities in Cyphor 0.19 allow remote attackers to execute arbitrary SQL and obtain administrative access via…

Published 21 y ago · modified 4 mo ago · JSON

CVSS
6.8
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
3.7%
percentile 90%
Public exploits
2
Exploit-DB

Multiple SQL injection vulnerabilities in Cyphor 0.19 allow remote attackers to execute arbitrary SQL and obtain administrative access via (1) the fid parameter of newmsg.php, which can enable XSS attacks when the SQL syntax is invalid or (2) the nick parameter of lostpwd.php.

Exploit prediction (EPSS)

3.69% probability of exploitation in the next 30 days, higher than 90% of all scored CVEs.

Exploits and detections

  • EDB-26338 Cyphor 0.19 - 'newmsg.php?fid' SQL Injection · webapps · 2005-10-08
  • EDB-26337 Cyphor 0.19 - 'lostpwd.php?nick' SQL Injection · webapps · 2005-10-08

CVSS scores

Assigned byVersionScoreVector
NVD2.06.8AV:N/AC:M/Au:N/C:P/I:P/A:P

References

  • securitytracker.com /id?1015020 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • osvdb.org /19944 · vdb-entry, x_refsource_OSVDB, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/22552 · vdb-entry, x_refsource_XF, x_transferred
  • securityreason.com /securityalert/70 · third-party-advisory, x_refsource_SREASON, x_transferred
  • osvdb.org /19945 · vdb-entry, x_refsource_OSVDB, x_transferred
  • secunia.com /advisories/17104/ · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • osvdb.org /19943 · vdb-entry, x_refsource_OSVDB, x_transferred
  • securityfocus.com /bid/15047 · vdb-entry, x_refsource_BID, x_transferred
  • marc.info /?l=bugtraq&m=112879353805769&w=2 · mailing-list, x_refsource_BUGTRAQ, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.