CVE-2004-1949

Description

SQL injection vulnerability in PostNuke 7.2.6 and earlier allows remote attackers to execute arbitrary SQL via (1) the sif parameter to index.php in the Comments module or (2) timezoneoffset parameter to changeinfo.php in the Your_Account module.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/15875

https://exchange.xforce.ibmcloud.com/vulnerabilities/15869

http://www.securityfocus.com/bid/10146

http://www.osvdb.org/5369

http://www.osvdb.org/5368

http://securitytracker.com/id?1009801

http://secunia.com/advisories/11386

http://news.postnuke.com/Article2580.html

http://marc.info/?l=bugtraq&m=108256503718978&w=2

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS