CVE-2005-4227
Multiple "potential" SQL injection vulnerabilities in DCP-Portal 6.1.1 might allow remote attackers to execute arbitrary SQL commands via (1) the password and username parameters in advertiser.php, (2) the aid parameter in announcement.php, (3) the…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (3.13%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Multiple "potential" SQL injection vulnerabilities in DCP-Portal 6.1.1 might allow remote attackers to execute arbitrary SQL commands via (1) the password and username parameters in advertiser.php, (2) the aid parameter in announcement.php, (3) the dcp5_member_id, year, agid, day, day_s, hour, minute, month, month_s, and year_s parameters in calendar.php, (4) the cid parameter in contents.php, (5) the dcp5_member_id parameter in forums.php, (6) the bid parameter in go.php, (7) the lid parameter in golink.php, (8) the dcp5_member_id and mid parameters in inbox.php, (9) the catid, dcat, and dl parameters in index.php, (10) the dcp5_member_id in informer.php, (11) the nid parameter in news.php, (12) the type and rate parameters in rate.php, (13) the q parameter in search.php, and (14) the dcp5_member_id in update.php. NOTE: other vectors in the PHP-CHECKER report are also covered by CVE-2005-3365 and CVE-2005-0454.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 3.13% probability · 87th percentile
- CISA KEV
- Not listed
- Affected
- codeworx technologies/dcp-portal
- Source
- cve@mitre.org
References
- http://glide.stanford.edu/yichen/research/sec.pdf
- http://secunia.com/advisories/12751
- http://www.osvdb.org/22017
- http://www.osvdb.org/22018
- http://www.osvdb.org/22019
- http://www.osvdb.org/22020
- http://www.osvdb.org/22021
- http://www.osvdb.org/22022
- http://www.osvdb.org/22023
- http://www.osvdb.org/22024
- http://www.osvdb.org/22025
- http://www.osvdb.org/22026
- http://www.osvdb.org/22027
- http://www.osvdb.org/22028
- http://www.osvdb.org/22029
- http://www.osvdb.org/22030
- http://www.osvdb.org/22031
- http://www.securityfocus.com/archive/1/419280/100/0/threaded
- http://www.securityfocus.com/archive/1/419487/100/0/threaded
- http://www.securityfocus.com/bid/15183
- http://www.vupen.com/english/advisories/2005/2863
- https://exchange.xforce.ibmcloud.com/vulnerabilities/22855
- http://glide.stanford.edu/yichen/research/sec.pdf
- http://secunia.com/advisories/12751
- http://www.osvdb.org/22017
- http://www.osvdb.org/22018
- http://www.osvdb.org/22019
- http://www.osvdb.org/22020
- http://www.osvdb.org/22021
- http://www.osvdb.org/22022
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.