CVE-2005-3394 - Vulnerability Details - OpenCVE

Multiple SQL injection vulnerabilities in forum.php in oaboard forum 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) channel parameter in the topics module and (2) topic parameter in the posting module.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Oaboard	Oaboard

Configuration 1 [-]

cpe:2.3:a:oaboard:oaboard:1.0:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://secunia.com/advisories/17373
http://www.osvdb.org/20420
http://www.securityfocus.com/archive/1/415299
http://www.securityfocus.com/bid/15245
http://www.vupen.com/english/advisories/2005/2258
https://exchange.xforce.ibmcloud.com/vulnerabilities/22932

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2005-11-01T11:00:00

Updated: 2024-08-07T23:10:08.536Z

Reserved: 2005-11-01T00:00:00

Link: CVE-2005-3394

Vulnrichment

No data.

NVD

Status : Modified

Published: 2005-11-01T12:47:00.000

Modified: 2024-11-21T00:01:47.150

Link: CVE-2005-3394

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2005-10-30T00:00:00", "descriptions": [{"lang": "en", "value": "Multiple SQL injection vulnerabilities in forum.php in oaboard forum 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) channel parameter in the topics module and (2) topic parameter in the posting module."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-19T14:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "ADV-2005-2258", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2005/2258"}, {"name": "17373", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/17373"}, {"name": "20420", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://www.osvdb.org/20420"}, {"name": "20051030 SQL IN FORUM.PHP", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/415299"}, {"name": "oaboard-forum-script-sql-injection(22932)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/22932"}, {"name": "15245", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/15245"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2005-3394", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Multiple SQL injection vulnerabilities in forum.php in oaboard forum 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) channel parameter in the topics module and (2) topic parameter in the posting module."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "ADV-2005-2258", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2005/2258"}, {"name": "17373", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/17373"}, {"name": "20420", "refsource": "OSVDB", "url": "http://www.osvdb.org/20420"}, {"name": "20051030 SQL IN FORUM.PHP", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/415299"}, {"name": "oaboard-forum-script-sql-injection(22932)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/22932"}, {"name": "15245", "refsource": "BID", "url": "http://www.securityfocus.com/bid/15245"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T23:10:08.536Z"}, "title": "CVE Program Container", "references": [{"name": "ADV-2005-2258", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2005/2258"}, {"name": "17373", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/17373"}, {"name": "20420", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://www.osvdb.org/20420"}, {"name": "20051030 SQL IN FORUM.PHP", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/415299"}, {"name": "oaboard-forum-script-sql-injection(22932)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/22932"}, {"name": "15245", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/15245"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2005-3394", "datePublished": "2005-11-01T11:00:00", "dateReserved": "2005-11-01T00:00:00", "dateUpdated": "2024-08-07T23:10:08.536Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:oaboard:oaboard:1.0:*:*:*:*:*:*:*", "matchCriteriaId": "3AD5C934-3DA0-4ED2-A475-A6EBE9B30BD5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Multiple SQL injection vulnerabilities in forum.php in oaboard forum 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) channel parameter in the topics module and (2) topic parameter in the posting module."}], "id": "CVE-2005-3394", "lastModified": "2024-11-21T00:01:47.150", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": true, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2005-11-01T12:47:00.000", "references": [{"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/17373"}, {"source": "cve@mitre.org", "url": "http://www.osvdb.org/20420"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/415299"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://www.securityfocus.com/bid/15245"}, {"source": "cve@mitre.org", "url": "http://www.vupen.com/english/advisories/2005/2258"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/22932"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/17373"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.osvdb.org/20420"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/415299"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://www.securityfocus.com/bid/15245"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.vupen.com/english/advisories/2005/2258"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/22932"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}