CVE-2005-4225

Description

Multiple "potential" SQL injection vulnerabilities in myBloggie 2.1.3 beta might allow remote attackers to execute arbitrary SQL commands via (1) the category parameter in add.php, (2) the cat_desc parameter in addcat.php, (3) the level and user parameters in adduser.php, (4) the post_id parameter in del.php, (5) the cat_id parameter in delcat.php, (6) the comment_id parameter in delcomment.php, (7) the id parameter in deluser.php, (8) the post_id and category parameter in edit.php, (9) the cat_id and cat_desc parameters in editcat.php, and (10) the id, level, and user parameters in edituser.php. NOTE: the username/login.php vector is already identified by CVE-2005-2838.

7.5

CVSS

Severity: High

CVSS 2.0 •

EPSS 2.12% Top 20%

Vendor Advisory secunia.com

Affected: n/a n/a

References

Link	Tags
http://www.securityfocus.com/archive/1/419280/100/0/threaded	mailing list
http://www.osvdb.org/21659	vdb entry
http://secunia.com/advisories/18024/	third party advisory vendor advisory
http://www.osvdb.org/21665	vdb entry
http://www.osvdb.org/21662	vdb entry
http://www.osvdb.org/21664	vdb entry
http://www.osvdb.org/21666	vdb entry
http://www.osvdb.org/21669	vdb entry
http://www.osvdb.org/21667	vdb entry
http://www.osvdb.org/21668	vdb entry
http://www.osvdb.org/21663	vdb entry
http://glide.stanford.edu/yichen/research/sec.pdf
http://www.osvdb.org/21660	vdb entry
http://www.vupen.com/english/advisories/2005/2862	vdb entry
http://www.securityfocus.com/archive/1/419487/100/0/threaded	mailing list
http://www.osvdb.org/21670	vdb entry
http://www.osvdb.org/21661	vdb entry

Frequently Asked Questions

What is the severity of CVE-2005-4225?: CVE-2005-4225 has been scored as a high severity vulnerability.
How to fix CVE-2005-4225?: To fix CVE-2005-4225, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2005-4225 being actively exploited in the wild?: It is possible that CVE-2005-4225 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~2% probability that this vulnerability will be exploited by malicious actors in the next 30 days.