CVE-2005-4606

SQL injection vulnerability in check_user.asp in multiple Web Wiz products including (1) Site News 3.06 and earlier, (2) Journal 1.0 and earlier, (3) Polls 3.06 and earlier, and (4) and Database Login 1.71 and earlier allows remote attackers to execute arbitrary SQL commands via the txtUserName parameter.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://secunia.com/advisories/18263	Patch Vendor Advisory
http://www.securityfocus.com/bid/16085	Exploit
http://www.osvdb.org/22148
http://securityreason.com/securityalert/305
http://www.vupen.com/english/advisories/2006/0007
http://www.securityfocus.com/archive/1/420551/100/0/threaded

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:webwiz:site_news::::::::
	cpe:2.3:a:webwiz:journal::::::::
	cpe:2.3:a:webwiz:database_login::::::::
	cpe:2.3:a:webwiz:weekly_poll::::::::
	cpe:2.3:a:webwiz:site_news:2.00:::::::*

Information

Published : 2005-12-30 21:00

Updated : 2018-10-19 08:41

NVD link : CVE-2005-4606

Mitre link : CVE-2005-4606

JSON object : View

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Advertisement

Products Affected

webwiz

site_news
weekly_poll
database_login
journal

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://secunia.com/advisories/18263", "name": "18263", "tags": ["Patch", "Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://www.securityfocus.com/bid/16085", "name": "16085", "tags": ["Exploit"], "refsource": "BID"}, {"url": "http://www.osvdb.org/22148", "name": "22148", "tags": [], "refsource": "OSVDB"}, {"url": "http://securityreason.com/securityalert/305", "name": "305", "tags": [], "refsource": "SREASON"}, {"url": "http://www.vupen.com/english/advisories/2006/0007", "name": "ADV-2006-0007", "tags": [], "refsource": "VUPEN"}, {"url": "http://www.securityfocus.com/archive/1/420551/100/0/threaded", "name": "20051230 [KAPDA::#18] - WebWiz Products SQL Injection", "tags": [], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "SQL injection vulnerability in check_user.asp in multiple Web Wiz products including (1) Site News 3.06 and earlier, (2) Journal 1.0 and earlier, (3) Polls 3.06 and earlier, and (4) and Database Login 1.71 and earlier allows remote attackers to execute arbitrary SQL commands via the txtUserName parameter."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-89"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2005-4606", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "HIGH", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2005-12-31T05:00Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:webwiz:site_news:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "3.06"}, {"cpe23Uri": "cpe:2.3:a:webwiz:journal:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "1.0"}, {"cpe23Uri": "cpe:2.3:a:webwiz:database_login:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "1.71"}, {"cpe23Uri": "cpe:2.3:a:webwiz:weekly_poll:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "3.06"}, {"cpe23Uri": "cpe:2.3:a:webwiz:site_news:2.00:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-19T15:41Z"}