PT-2005-3297 · Php · Phpnews

Rst · Published 2005-07-26 · Updated 2016-10-18 · CVE-2005-2383

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHPNews version 1.2.5

Description The issue allows remote attackers to execute arbitrary SQL commands via the user parameter in an HTTP POST request. This is a SQL injection vulnerability in the auth.php file.

Recommendations For PHPNews version 1.2.5, consider restricting access to the auth.php file or validating and sanitizing the user parameter to prevent SQL injection attacks. As a temporary workaround, avoid using the user parameter in the affected HTTP POST request until a patch is available.

Exploit

Fix

Related Identifiers

CVE-2005-2383

Affected Products

Phpnews

References · 6

• 🔥 https://exploit-db.com/exploits/26016 · Exploit
• http://newsphp.sourceforge.net/changelog/changelog_1.30.txt · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2005-2383 · Security Note
• http://securityfocus.com/bid/14333 · Note
• http://secunia.com/advisories/16148 · Note
• http://marc.info/?l=bugtraq&m=112189453304389&w=2 · Note