CVE-2005-4223

Description

Multiple "potential" SQL injection vulnerabilities in Utopia News Pro (UNP) 1.1.4 might allow remote attackers to execute arbitrary SQL commands via (1) the newsid parameter in editnews.php, (2) the catid and question parameters in faq.php, (3) the poster parameter in postnews.php, (4) the tempid parameter in templates.php, and (5) the userid and groupid parameters in users.php.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/23564

http://www.vupen.com/english/advisories/2005/2859

http://www.securityfocus.com/archive/1/419487/100/0/threaded

http://www.securityfocus.com/archive/1/419280/100/0/threaded

http://www.osvdb.org/21649

http://www.osvdb.org/21648

http://www.osvdb.org/21647

http://www.osvdb.org/21646

http://www.osvdb.org/21645

http://secunia.com/advisories/17988/

http://glide.stanford.edu/yichen/research/sec.pdf

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS