PT-2005-4912 · E107 · E107

Published 2005-12-14 · Updated 2018-10-19 · CVE-2005-4224

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions e107 version 0.7

Description The issue allows remote attackers to execute arbitrary SQL commands. This is possible via several parameters in different PHP files, including email, hideemail, image, realname, signature, timezone, and xupexist in "signup.php", content comment, content rating, and content summary in "subcontent.php", download category and file demo in "upload.php", and email, hideemail, user timezone, and user xup in "usersettings.php".

Recommendations For e107 version 0.7, as a temporary workaround, consider restricting access to the vulnerable parameters until a patch is available. Avoid using the parameters email, hideemail, image, realname, signature, timezone, xupexist, content comment, content rating, content summary, download category, file demo, user timezone, and user xup in the affected PHP files.

Fix

Related Identifiers

CVE-2005-4224

Affected Products

E107

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2005-4224 · Security Note
• http://secunia.com/advisories/18023 · Vendor Advisory
• http://osvdb.org/21659 · Note
• http://osvdb.org/21657 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4224 · Note
• http://osvdb.org/21658 · Note
• http://glide.stanford.edu/yichen/research/sec.pdf · Note
• http://securityfocus.com/archive/1/419280/100/0/threaded · Note
• http://osvdb.org/21660 · Note
• http://vupen.com/english/advisories/2005/2861 · Note
• http://securityfocus.com/archive/1/419487/100/0/threaded · Note