CVE-2005-1633
Multiple SQL injection vulnerabilities in JGS-XA JGS-Portal 3.0.2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) anzahl_beitraege parameter to jgs_portal.php, 2) year parameter to (jgs_portal_statistik.php, 3) year…
Does this matter?
7 public exploits are published in Exploit-DB (verified) and the impact is high, while EPSS rates exploitation at 2.0%. Anyone can run this; patch or mitigate before the next change window and check exposed instances for signs of use.
Description
Multiple SQL injection vulnerabilities in JGS-XA JGS-Portal 3.0.2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) anzahl_beitraege parameter to jgs_portal.php, 2) year parameter to (jgs_portal_statistik.php, 3) year parameter to (jgs_portal_beitraggraf.php, 4) tag parameter to (jgs_portal_viewsgraf.php, 5) year parameter to (jgs_portal_themengraf.php, 6) year parameter to (jgs_portal_mitgraf.php, 7) id parameter to jgs_portal_sponsor.php, or (8) the Accept-Language header to jgs_portal_log.php.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 2.00% probability · 81th percentile
- Public exploits
- 7 in Exploit-DB · verified · first 16 May 2005
- CISA KEV
- Not listed
- Affected
- jgs-xa/jgs-portal
- Source
- cve@mitre.org
EPSS 2.0% since 26 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
Public exploits (7)
Entries in Exploit-DB that cite this CVE. Links go to the Exploit-DB page and to the file in the public repository; nothing is hosted here. A verified tick means the Exploit-DB team confirmed the exploit works against the stated version.
| EDB-ID | Title | Type | Published | Verified |
|---|---|---|---|---|
| EDB-25679source ↗ | JGS-Portal 3.0.1/3.0.2 - 'jgs_portal_sponsor.php?id' SQL Injectionphp · deluxe@security-project.org | webapps | 16 May 2005 | yes |
| EDB-25678source ↗ | JGS-Portal 3.0.1/3.0.2 - 'jgs_portal_mitgraf.php?year' SQL Injectionphp · deluxe@security-project.org | webapps | 16 May 2005 | yes |
| EDB-25677source ↗ | JGS-Portal 3.0.1/3.0.2 - 'jgs_portal_themengraf.php?year' SQL Injectionphp · deluxe@security-project.org | webapps | 16 May 2005 | yes |
| EDB-25676source ↗ | JGS-Portal 3.0.1/3.0.2 - 'jgs_portal_viewsgraf.php?tag' SQL Injectionphp · deluxe@security-project.org | webapps | 16 May 2005 | yes |
| EDB-25675source ↗ | JGS-Portal 3.0.1/3.0.2 - 'jgs_portal_beitraggraf.php?year' SQL Injectionphp · deluxe@security-project.org | webapps | 16 May 2005 | yes |
| EDB-25674source ↗ | JGS-Portal 3.0.1/3.0.2 - 'jgs_portal.php?anzahl_beitraege' SQL Injectionphp · deluxe@security-project.org | webapps | 16 May 2005 | yes |
| EDB-25673source ↗ | JGS-Portal 3.0.1/3.0.2 - 'jgs_portal_statistik.php?year' SQL Injectionphp · deluxe@security-project.org | webapps | 16 May 2005 | yes |
References
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.