CVE-2009-4838

CVE-2009-4838 : A SQL injection vulnerability exists in Base_Ag_Common.php of the Basic Analysis and Security Engine (BASE) before version 1.4.3.1. Remote attackers can execute arbitrary SQL commands via unspecified parameters due to inadequate input handling. This risk affects BASE deployments r...

CVE-2005-3325

CVE-2005-3325 concerns SQL injection in ACID/BASE consoles (acidlab/acidbase) due to missing input sanitising and improper parameter validation. Debian and related advisories (DSA-893-1) confirm remote exploitation via base_qry_main.php/acid_qry_main.php and related console components, with fixed...

CVE-2007-5578

BASE is affected: the Basic Analysis and Security Engine (BASE) before version 1.3.8 fails to exit after issuing a redirect, enabling remote attackers to bypass authentication via multiple scripts (notably base_main.php and base_qry_alert.php). Exploitation details are not provided in the connect...

CVE-2012-1198

CVE-2012-1198 affects BASE 1.4.5. The issue occurs in base_ag_main.php where an attacker can upload a file with an executable extension via a create action and then access it via a view action, enabling remote code execution. The NVD entry assigns a CVSSv2 base score of 7.5 (HIGH) with network ac...

CVE-2012-1199

BASE 1.4.5 contains multiple PHP remote file inclusion vulnerabilities that allow an attacker to execute arbitrary PHP code by passing a URL to the BASE_path parameter (and related parameters) to various BASE scripts (e.g., base_ag_main.php, base_db_setup.php, base_graph_.php, base_qry_ .php, bas...