PT-2005-4770 · Web4Future · Web4Future Edating Professional

Published 2005-12-06 · Updated 2011-03-08 · CVE-2005-4034

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Web4Future eDating Professional version 5

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved through SQL injection vulnerabilities in several parameters, including s, pg, and sortb in "index.php", cid in "gift.php" and "fq.php", and cat in "articles.php".

Recommendations For Web4Future eDating Professional version 5, consider restricting access to the vulnerable parameters s, pg, sortb, cid, and cat in the respective files until a patch is available. As a temporary workaround, avoid using these parameters in the affected API endpoints.

Exploit

Fix

Related Identifiers

CVE-2005-4034

Affected Products

Web4Future Edating Professional

References · 13

• 🔥 http://osvdb.org/21420 · Exploit
• 🔥 http://securityfocus.com/bid/15715 · Exploit
• 🔥 http://osvdb.org/21421 · Exploit
• 🔥 http://osvdb.org/21419 · Exploit
• 🔥 https://exploit-db.com/exploits/26727 · Exploit
• 🔥 http://osvdb.org/21418 · Exploit
• 🔥 https://exploit-db.com/exploits/26724 · Exploit
• 🔥 https://exploit-db.com/exploits/26725 · Exploit
• 🔥 https://exploit-db.com/exploits/26726 · Exploit
• http://secunia.com/advisories/17879 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-4034 · Security Note
• http://pridels0.blogspot.com/2005/12/web4future-edating-professional-v5-sql.html · Note
• http://vupen.com/english/advisories/2005/2734 · Note