CVE-2005-3555

Multiple SQL injection vulnerabilities in PHPlist 2.10.1 and earlier allow authenticated remote attackers with administrator privileges to execute arbitrary SQL commands via the id parameter in the (1) editattributes or (2) admin page.

CVSS v2.0 6.5 MEDIUM

6.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.trapkit.de/advisories/TKADV2005-11-001.txt	Exploit Patch Vendor Advisory
http://secunia.com/advisories/17476	Patch Vendor Advisory
http://www.securityfocus.com/bid/15350
http://osvdb.org/20567
http://osvdb.org/20568
http://www.vupen.com/english/advisories/2005/2345
http://www.securityfocus.com/archive/1/416005/30/0/threaded

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:a:tincan:phplist:*:*:*:*:*:*:*:*

Information

Published : 2005-11-15 23:42

Updated : 2018-10-19 08:37

NVD link : CVE-2005-3555

Mitre link : CVE-2005-3555

JSON object : View

CWE

NVD-CWE-Other

Advertisement

Products Affected

tincan

phplist

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.trapkit.de/advisories/TKADV2005-11-001.txt", "name": "http://www.trapkit.de/advisories/TKADV2005-11-001.txt", "tags": ["Exploit", "Patch", "Vendor Advisory"], "refsource": "MISC"}, {"url": "http://secunia.com/advisories/17476", "name": "17476", "tags": ["Patch", "Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://www.securityfocus.com/bid/15350", "name": "15350", "tags": [], "refsource": "BID"}, {"url": "http://osvdb.org/20567", "name": "20567", "tags": [], "refsource": "OSVDB"}, {"url": "http://osvdb.org/20568", "name": "20568", "tags": [], "refsource": "OSVDB"}, {"url": "http://www.vupen.com/english/advisories/2005/2345", "name": "ADV-2005-2345", "tags": [], "refsource": "VUPEN"}, {"url": "http://www.securityfocus.com/archive/1/416005/30/0/threaded", "name": "20051107 [TKADV2005-11-001] Multiple vulnerabilities in PHPlist", "tags": [], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Multiple SQL injection vulnerabilities in PHPlist 2.10.1 and earlier allow authenticated remote attackers with administrator privileges to execute arbitrary SQL commands via the id parameter in the (1) editattributes or (2) admin page."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2005-3555", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}}, "publishedDate": "2005-11-16T07:42Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:tincan:phplist:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "2.10.1"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-19T15:37Z"}