VulnerabilityModified
CVE-2005-3952
SQL injection vulnerability in PHP Labs Top Auction allows remote attackers to execute arbitrary SQL commands via the (1) category and (2) type parameters to viewcat.php, or (3) certain search parameters.
HIGH 7.5EPSS 2.52%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.52%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
SQL injection vulnerability in PHP Labs Top Auction allows remote attackers to execute arbitrary SQL commands via the (1) category and (2) type parameters to viewcat.php, or (3) certain search parameters. NOTE: later a disclosure reported the affected version as 1.0.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 2.52% probability · 84th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-89
- Affected
- php labs/top auction
- Source
- cve@mitre.org
References
- http://pridels0.blogspot.com/2005/11/top-auction-multiple-sql-vuln.html
- http://secunia.com/advisories/17687Vendor Advisory
- http://www.osvdb.org/21105
- http://www.osvdb.org/21106
- http://www.securityfocus.com/archive/1/466565/100/200/threaded
- http://www.securityfocus.com/archive/1/466569/100/200/threaded
- http://www.securityfocus.com/bid/15547
- http://www.vupen.com/english/advisories/2005/2552Vendor Advisory
- https://www.exploit-db.com/exploits/3456
- http://pridels0.blogspot.com/2005/11/top-auction-multiple-sql-vuln.html
- http://secunia.com/advisories/17687Vendor Advisory
- http://www.osvdb.org/21105
- http://www.osvdb.org/21106
- http://www.securityfocus.com/archive/1/466565/100/200/threaded
- http://www.securityfocus.com/archive/1/466569/100/200/threaded
- http://www.securityfocus.com/bid/15547
- http://www.vupen.com/english/advisories/2005/2552Vendor Advisory
- https://www.exploit-db.com/exploits/3456
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.