PT-2005-5197 · Webdb · Webdb

Published 2005-12-23 · Updated 2024-08-08 · CVE-2005-4515

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WebDB versions 1.1 and earlier

Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands via unspecified search parameters, possibly Search0. The vendor has disputed this issue, stating that the flaw was in custom code added for a client and has since been removed, with no installations or patches required for clients.

Recommendations For WebDB versions 1.1 and earlier, no action is required on the part of customers, as the vendor has removed the flawed code and all users of the software begin to use the latest changes immediately.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2005-4515

Affected Products

Webdb

References · 8

• http://secunia.com/advisories/18226 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-4515 · Security Note
• http://vupen.com/english/advisories/2005/3071 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/23840 · Note
• http://securityfocus.com/bid/16038 · Note
• http://pridels0.blogspot.com/2005/12/webdb-sql-inj-vuln.html#c114176251867558161 · Note
• http://pridels0.blogspot.com/2005/12/webdb-sql-inj-vuln.html · Note
• http://osvdb.org/21910 · Note