PT-2005-5045 · Odfaq · Odfaq

Published 2005-12-20 · Updated 2011-03-08 · CVE-2005-4359

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions ODFaq version 2.1.0

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the cat and srcText parameters to the "faq.php" endpoint.

Recommendations For ODFaq version 2.1.0, consider restricting access to the faq.php endpoint until a patch is available. As a temporary workaround, avoid using the cat and srcText parameters in the affected endpoint to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2005-4359

Affected Products

Odfaq

References · 5

• http://secunia.com/advisories/18121 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-4359 · Security Note
• http://pridels0.blogspot.com/2005/12/odfaq-sql-inj-vuln.html · Note
• http://vupen.com/english/advisories/2005/2994 · Note
• http://osvdb.org/21790 · Note