CVE-2004-0323

Multiple SQL injection vulnerabilities in XMB 1.8 Final SP2 allow remote attackers to inject arbitrary SQL and gain privileges via the (1) ppp parameter in viewthread.php, (2) desc parameter in misc.php, (3) tpp parameter in forumdisplay.php, (4) ascdesc parameter in forumdisplay.php, or (5) the addon parameter in stats.php. NOTE: it has also been shown that item (3) is also in XMB 1.9 beta.

CVSS v2.0

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

4.02% chance of exploitation in the next 30 days, 90th percentile

Published

2004-03-18

Updated

2024-08-08

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/23748

References

• CVE Record
• NVD entry

Related

• CVE-2004-0322
• CVE-2004-0325
• CVE-2004-0319
• CVE-2004-0326
• CVE-2004-0318
• CVE-2004-0327