Lucene search
HistoryApr 21, 2005 - 4:00 a.m.
CVE-2001-1472
cve-2001-1472
sql injection
phpbb
remote authenticated users
arbitrary sql commands
admin access
prefs.php
viewemail parameter.
4.6 Medium
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:P/I:P/A:P
8.5 High
AI Score
Confidence
Low
0.001 Low
EPSS
Percentile
43.6%
SQL injection vulnerability in prefs.php in phpBB 1.4.0 and 1.4.1 allows remote authenticated users to execute arbitrary SQL commands and gain administrative access via the viewemail parameter.
Affected configurations
Node
phpbb_groupphpbbMatch1.4.0
ORphpbb_groupphpbbMatch1.4.1
| CPE | Name | Operator | Version |
|---|---|---|---|
| phpbb_group:phpbb | phpbb group phpbb | eq | 1.4.0 |
| phpbb_group:phpbb | phpbb group phpbb | eq | 1.4.1 |
4.6 Medium
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:P/I:P/A:P
8.5 High
AI Score
Confidence
Low
0.001 Low
EPSS
Percentile
43.6%
Related for CVE-2001-1472