Unscored severity · published Dec 31, 2005
CVE-2005-2468
Multiple SQL injection vulnerabilities in MySQL Eventum 1.5.5 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) isCorrectPassword or (2) userExist…
–
CVSS
2%
EPSS
No
On KEV
Description
Multiple SQL injection vulnerabilities in MySQL Eventum 1.5.5 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) isCorrectPassword or (2) userExist function in class.auth.php, getCustomFieldReport function in (4) custom_fields.php, (5) custom_fields_graph.php, or (6) class.report.php, or the insert function in (7) releases.php or (8) class.release.php.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EV
Eventum · Mysql
1.1; 1.2; 1.2.2; 1.3; 1.3.1; 1.4; +2 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2005-2468
CVE.org
https://www.cve.org/CVERecord?id=CVE-2005-2468
Patch
http://lists.mysql.com/eventum-users/2072
marc.info
http://marc.info/?l=bugtraq&m=112292193807958&w=2
Patch
http://secunia.com/advisories/16304
Exploit
http://securitytracker.com/id?1014603
Exploit
http://www.gulftech.org/?node=research&article_id=00093-07312005
Exploit
http://www.osvdb.org/18403
More from Eventum
–
CVE-2005-2467
Multiple cross-site scripting (XSS) vulnerabilities in MySQL Eventum 1.5.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to…