Unscored severity · published Dec 30, 2005
CVE-2005-4586
Multiple SQL injection vulnerabilities in PHPSurveyor before 0.991 allow remote attackers to execute arbitrary SQL commands via the (1) sql parameter in browse.php and the (2)…
–
CVSS
1.4%
EPSS
No
On KEV
Description
Multiple SQL injection vulnerabilities in PHPSurveyor before 0.991 allow remote attackers to execute arbitrary SQL commands via the (1) sql parameter in browse.php and the (2) sid, (3) lid, (4) gid, and (5) token parameters in certain PHP scripts.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PH
Phpsurveyor · Phpsurveyor
0.99 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2005-4586
CVE.org
https://www.cve.org/CVERecord?id=CVE-2005-4586
Patch
http://secunia.com/advisories/18167
Patch
http://sourceforge.net/project/shownotes.php?release_id=381050&group_id=74605
www.osvdb.org
http://www.osvdb.org/22039
www.osvdb.org
http://www.osvdb.org/22184
www.phpsurveyor.org
http://www.phpsurveyor.org/mantis/view.php?id=286
www.phpsurveyor.org
http://www.phpsurveyor.org/mantis/view.php?id=287
More from Phpsurveyor
–
CVE-2006-2065
SQL injection vulnerability in save.php in PHPSurveyor 0.995 and earlier allows remote attackers to execute arbitrary SQL commands via the surveyid cookie