Unscored severity · published Jun 9, 2005
CVE-2005-1946
Multiple SQL injection vulnerabilities in Invision Blog before 1.1.2 Final allow remote attackers to execute arbitrary SQL commands via the (1) eid parameter to an editentry,…
–
CVSS
1.3%
EPSS
No
On KEV
Description
Multiple SQL injection vulnerabilities in Invision Blog before 1.1.2 Final allow remote attackers to execute arbitrary SQL commands via the (1) eid parameter to an editentry, replyentry, or editcomment action, or (2) the mid parameter to an aboutme action.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IC
Invision Community Blog · Invision Power Services
1.0; 1.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2005-1946
CVE.org
https://www.cve.org/CVERecord?id=CVE-2005-1946
marc.info
http://marc.info/?l=bugtraq&m=111833601302752&w=2
secunia.com
http://secunia.com/advisories/15626
Exploit
http://www.gulftech.org/?node=research&article_id=00078-06072005
More from Invision Community Blog
–
CVE-2006-6369
SQL injection vulnerability in lib/entry_reply_entry.php in Invision Community Blog Mod 1.2.4 allows remote attackers to execute arbitrary SQL commands via the eid parameter, when…
–
CVE-2006-2251
SQL injection vulnerability in the do_mmod function in mod.php in Invision Community Blog (ICB) 1.1.2 final through 1.2 allows remote attackers with moderator privileges to…
–
CVE-2005-1945
Cross-site scripting (XSS) vulnerability in the convert_highlite_words function in Invision Blog before 1.1.2 Final allows remote attackers to inject arbitrary web script or HTML…
–
CVE-2005-0217
SQL injection vulnerability in index.php in Invision Community Blog allows remote attackers to execute arbitrary SQL commands via the eid parameter