Unscored severity · published Jun 9, 2005
CVE-2005-1948
Multiple SQL injection vulnerabilities in Invision Gallery before 1.3.1 allow remote attackers to execute arbitrary SQL commands via (1) the comment parameter in an editcomment…
–
CVSS
1.2%
EPSS
No
On KEV
Description
Multiple SQL injection vulnerabilities in Invision Gallery before 1.3.1 allow remote attackers to execute arbitrary SQL commands via (1) the comment parameter in an editcomment action or (2) the rating parameter when voting on a photo.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 67% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IG
Invision Gallery · Invision Power Services
1.0.1; 1.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2005-1948
CVE.org
https://www.cve.org/CVERecord?id=CVE-2005-1948
marc.info
http://marc.info/?l=bugtraq&m=111834146710329&w=2
Exploit
http://www.gulftech.org/?node=research&article_id=00079-06092005
www.securityfocus.com
http://www.securityfocus.com/bid/13907
More from Invision Gallery
–
CVE-2008-0421
SQL injection vulnerability in Invision Gallery 2.0.7 and earlier allows remote attackers to execute arbitrary SQL commands via the album parameter in a rate command
–
CVE-2006-6370
SQL injection vulnerability in forum/modules/gallery/post.php in Invision Gallery 2.0.7 allows remote attackers to cause a denial of service and possibly have other impacts, as…
–
CVE-2006-5205
Directory traversal vulnerability in Invision Gallery 2.0.7 allows remote attackers to read arbitrary files via a
–
CVE-2006-5206
SQL injection vulnerability in Invision Gallery 2.0.7 allows remote attackers to execute arbitrary SQL commands via the album parameter in (1) index.php and (2) forum/index.php,…
–
CVE-2006-2202
SQL injection vulnerability in post.php in Invision Gallery 2.0.6 allows remote attackers to execute arbitrary SQL commands via the album parameter