CVE-2005-2478

SQL injection vulnerability in SilverNews 2.0.3 allows remote attackers to execute arbitrary SQL commands via the user field on the login page in the Admin control panel.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.rgod.altervista.org/silvernews.html	Exploit
http://secunia.com/advisories/16315	Patch Vendor Advisory
http://www.securityfocus.com/bid/14466
http://www.osvdb.org/18517
http://securitytracker.com/id?1014622
http://marc.info/?l=bugtraq&m=112309780321088&w=2
https://exchange.xforce.ibmcloud.com/vulnerabilities/21688

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:a:silver-scripts:silvernews:2.0.3:*:*:*:*:*:*:*

Information

Published : 2005-08-04 21:00

Updated : 2017-07-10 18:32

NVD link : CVE-2005-2478

Mitre link : CVE-2005-2478

JSON object : View

CWE

NVD-CWE-Other

Advertisement

Products Affected

silver-scripts

silvernews

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.rgod.altervista.org/silvernews.html", "name": "http://www.rgod.altervista.org/silvernews.html", "tags": ["Exploit"], "refsource": "MISC"}, {"url": "http://secunia.com/advisories/16315", "name": "16315", "tags": ["Patch", "Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://www.securityfocus.com/bid/14466", "name": "14466", "tags": [], "refsource": "BID"}, {"url": "http://www.osvdb.org/18517", "name": "18517", "tags": [], "refsource": "OSVDB"}, {"url": "http://securitytracker.com/id?1014622", "name": "1014622", "tags": [], "refsource": "SECTRACK"}, {"url": "http://marc.info/?l=bugtraq&m=112309780321088&w=2", "name": "20050803 Silvernews 2.0.3 (possibly previous versions ) SQL Injection / Login Bypass / Remote commands execution / cross site scripting", "tags": [], "refsource": "BUGTRAQ"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/21688", "name": "silvernews-username-sql-injection(21688)", "tags": [], "refsource": "XF"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "SQL injection vulnerability in SilverNews 2.0.3 allows remote attackers to execute arbitrary SQL commands via the user field on the login page in the Admin control panel."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2005-2478", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "HIGH", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}}, "publishedDate": "2005-08-05T04:00Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:silver-scripts:silvernews:2.0.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2017-07-11T01:32Z"}