PT-2005-4683 · Ilyav · Ilyav Faq System

Published 2005-12-01 · Updated 2011-03-08 · CVE-2005-3943

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ilyav FAQ System versions 1.1 and earlier

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the FAQ ID and action parameters in "viewFAQ.php", and the CATEGORY ID parameter in "index.php".

Recommendations For ilyav FAQ System versions 1.1 and earlier, consider restricting access to the vulnerable parameters FAQ ID, action, and CATEGORY ID in the affected files "viewFAQ.php" and "index.php" until a patch is available. Avoid using these parameters in the respective API endpoints to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2005-3943

Affected Products

Ilyav Faq System

References · 8

• 🔥 https://exploit-db.com/exploits/26660 · Exploit
• 🔥 http://osvdb.org/21202 · Exploit
• 🔥 http://securityfocus.com/bid/15640 · Exploit
• 🔥 https://exploit-db.com/exploits/26659 · Exploit
• http://secunia.com/advisories/17801 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-3943 · Security Note
• http://vupen.com/english/advisories/2005/2653 · Note
• http://pridels0.blogspot.com/2005/11/faq-system-11-sql-inj-vuln.html · Note