CVE-2005-4144

Lyris ListManager 5.0 through 8.9a allows remote attackers to add "ORDER BY" columns to SQL queries via unusual whitespace characters in the orderby parameter, such as (1) newlines and (2) 0xFF (ASCII 255) characters, which are interpreted as whitespace.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://metasploit.com/research/vulns/lyris_listmanager/	Vendor Advisory
http://secunia.com/advisories/17943	Patch Vendor Advisory
http://archives.neohapsis.com/archives/fulldisclosure/2005-12/0349.html
http://www.securityfocus.com/bid/15787	Patch
http://www.osvdb.org/21549	Patch
http://www.vupen.com/english/advisories/2005/2820
http://www.securityfocus.com/archive/1/419077/100/0/threaded

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:lyris:list_manager:5.0:::::::*
	cpe:2.3:a:lyris:list_manager:6.0:::::::*
	cpe:2.3:a:lyris:list_manager:7.0:::::::*
	cpe:2.3:a:lyris:list_manager:8.0:::::::*
	cpe:2.3:a:lyris:list_manager:8.8a:::::::*

Information

Published : 2005-12-10 03:03

Updated : 2018-10-19 08:40

NVD link : CVE-2005-4144

Mitre link : CVE-2005-4144

JSON object : View

CWE

NVD-CWE-Other

Products Affected

lyris

list_manager

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://metasploit.com/research/vulns/lyris_listmanager/", "name": "http://metasploit.com/research/vulns/lyris_listmanager/", "tags": ["Vendor Advisory"], "refsource": "MISC"}, {"url": "http://secunia.com/advisories/17943", "name": "17943", "tags": ["Patch", "Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://archives.neohapsis.com/archives/fulldisclosure/2005-12/0349.html", "name": "20051208 PGP Wipe Free Space, Lyris ListManager Flaws, Windows Timestamps, Sam Juicer", "tags": [], "refsource": "FULLDISC"}, {"url": "http://www.securityfocus.com/bid/15787", "name": "15787", "tags": ["Patch"], "refsource": "BID"}, {"url": "http://www.osvdb.org/21549", "name": "21549", "tags": ["Patch"], "refsource": "OSVDB"}, {"url": "http://www.vupen.com/english/advisories/2005/2820", "name": "ADV-2005-2820", "tags": [], "refsource": "VUPEN"}, {"url": "http://www.securityfocus.com/archive/1/419077/100/0/threaded", "name": "20051209 PGP Wipe Free Space, Lyris ListManager Flaws, Windows Timestamps, Sam Juicer", "tags": [], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Lyris ListManager 5.0 through 8.9a allows remote attackers to add \"ORDER BY\" columns to SQL queries via unusual whitespace characters in the orderby parameter, such as (1) newlines and (2) 0xFF (ASCII 255) characters, which are interpreted as whitespace."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2005-4144", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "HIGH", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}}, "publishedDate": "2005-12-10T11:03Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:lyris:list_manager:5.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:lyris:list_manager:6.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:lyris:list_manager:7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:lyris:list_manager:8.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:lyris:list_manager:8.8a:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-19T15:40Z"}

7.5 /10