PT-2005-5104 · Honeycomb · Honeycomb Archive+1

Published 2005-12-20 · Updated 2017-07-20 · CVE-2005-4419

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Honeycomb Archive versions 3.0 Honeycomb Archive Enterprise versions 3.0

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved through SQL injection vulnerabilities in the CategoryResults.cfm file. The vulnerable parameters are series, cat parent, cat, and div.

Recommendations For Honeycomb Archive version 3.0, update to a version that includes a fix for the SQL injection vulnerabilities. For Honeycomb Archive Enterprise version 3.0, update to a version that includes a fix for the SQL injection vulnerabilities. As a temporary workaround, consider restricting access to the CategoryResults.cfm file until a patch is available. Avoid using the parameters series, cat parent, cat, and div in the affected CategoryResults.cfm file until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2005-4419

Affected Products

Honeycomb Archive

Honeycomb Archive Enterprise

References · 8

• 🔥 https://exploit-db.com/exploits/26920 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-4419 · Security Note
• http://osvdb.org/21827 · Note
• http://pridels0.blogspot.com/2005/12/honeycomb-archive-honeycomb-archive.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/23829 · Note
• http://securityfocus.com/bid/15995 · Note
• http://attrition.org/pipermail/vim/2006-March/000580.html · Note
• http://secunia.com/advisories/18127 · Note