PT-2005-4692 · Php · Php Labs Top Auction

Ajann · Published 2005-12-01 · Updated 2018-10-19 · CVE-2005-3952

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHP Labs Top Auction version 1.0

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the category and type parameters to "viewcat.php", or certain search parameters.

Recommendations For version 1.0, consider restricting access to the vulnerable parameters category and type in the "viewcat.php" endpoint until a patch is available. Avoid using certain search parameters in the affected API endpoint until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2005-3952

Affected Products

Php Labs Top Auction

References · 10

• 🔥 https://exploit-db.com/exploits/3456 · Exploit
• http://vupen.com/english/advisories/2005/2552 · Vendor Advisory
• http://secunia.com/advisories/17687 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-3952 · Security Note
• http://osvdb.org/21106 · Note
• http://securityfocus.com/archive/1/466569/100/200/threaded · Note
• http://pridels0.blogspot.com/2005/11/top-auction-multiple-sql-vuln.html · Note
• http://osvdb.org/21105 · Note
• http://securityfocus.com/bid/15547 · Note
• http://securityfocus.com/archive/1/466565/100/200/threaded · Note