Lucene search

[email protected]CVE-2005-4606

HistoryDec 31, 2005 - 5:00 a.m.

CVE-2005-4606

2005-12-3105:00:00

CWE-89

[email protected]

web.nvd.nist.gov

cve-2005-4606

sql injection

web wiz

security vulnerability

remote attack

8.8 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.003 Low

EPSS

Percentile

68.0%

JSON

SQL injection vulnerability in check_user.asp in multiple Web Wiz products including (1) Site News 3.06 and earlier, (2) Journal 1.0 and earlier, (3) Polls 3.06 and earlier, and (4) and Database Login 1.71 and earlier allows remote attackers to execute arbitrary SQL commands via the txtUserName parameter.

CPENameOperatorVersion
webwiz:journalwebwiz journalle1.0
webwiz:site_newswebwiz site newsle3.06
webwiz:database_loginwebwiz database loginle1.71
webwiz:site_newswebwiz site newseq2.00
webwiz:weekly_pollwebwiz weekly pollle3.06

CPE	Name	Operator	Version
webwiz:journal	webwiz journal	le	1.0
webwiz:site_news	webwiz site news	le	3.06
webwiz:database_login	webwiz database login	le	1.71
webwiz:site_news	webwiz site news	eq	2.00
webwiz:weekly_poll	webwiz weekly poll	le	3.06

References

secunia.com/advisories/18263

securityreason.com/securityalert/305

www.osvdb.org/22148

www.securityfocus.com/archive/1/420551/100/0/threaded

www.securityfocus.com/bid/16085

www.vupen.com/english/advisories/2006/0007

8.8 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.003 Low

EPSS

Percentile

68.0%

JSON

Related for CVE-2005-4606

nessus1