PT-2005-1869 · Phpmyfamily · Phpmyfamily

Kre0N · Published 2005-03-24 · Updated 2017-07-11 · CVE-2005-0841

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phpMyFamily version 1.4.0

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved through the person parameter to the "people.php" endpoint or the Login field.

Recommendations For phpMyFamily version 1.4.0, consider restricting access to the affected php files, such as people.php, track.php, edit.php, document.php, census.php, and passthru.php, until a patch is available. As a temporary workaround, avoid using the person parameter in the "people.php" endpoint and restrict the use of the Login field in the affected scripts. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2005-0841

Affected Products

Phpmyfamily

References · 7

• 🔥 http://securitytracker.com/id?1013493 · Exploit
• 🔥 http://securityfocus.com/bid/12860 · Exploit
• 🔥 https://exploit-db.com/exploits/892 · Exploit
• http://secunia.com/advisories/14642 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-0841 · Security Note
• http://marc.info/?l=bugtraq&m=111143649730845&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19787 · Note