CVE-2005-0413

Multiple SQL injection vulnerabilities in MyPHP Forum 1.0 allow remote attackers to execute arbitrary SQL commands via (1) the fid in forum.php, (2) the member parameter in member.php, (3) the email parameter in forgot.php, or (4) the nbuser or nbpass parameters in include.php. NOTE: it was later reported that vector 2 exists in 3.0 and earlier.

CVSS v2.0

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

2.08% chance of exploitation in the next 30 days, 80th percentile

Published

2005-02-14

Updated

2024-08-07

Proof-of-concept exploits (1)

• https://www.exploit-db.com/exploits/4822

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/807

References

• CVE Record
• NVD entry

Related

• CVE-2005-0411
• CVE-2005-0414
• CVE-2005-0410
• CVE-2005-0416
• CVE-2005-0409
• CVE-2005-0419