PT-2005-3764 · Class 1 · Class-1 Forum

Retrogod · Published 2005-09-14 · Updated 2017-07-11 · CVE-2005-2902

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions class-1 Forum Software version 0.24.4

Description The issue allows remote attackers to execute arbitrary SQL commands and bypass the file extension check via SQL code in the file extension of an uploaded file.

Recommendations For class-1 Forum Software version 0.24.4, update to a version that fixes this issue, as the current version allows for SQL injection attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2005-2902

Affected Products

Class-1 Forum

References · 6

• 🔥 http://securityfocus.com/bid/14774 · Exploit
• 🔥 http://rgod.altervista.org/class1.html · Exploit
• http://secunia.com/advisories/16762 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-2902 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/22209 · Note
• http://marc.info/?l=bugtraq&m=112629627512785&w=2 · Note