CVE-2005-1384

Multiple SQL injection vulnerabilities in phpCoin 1.2.2 allow remote attackers to execute arbitrary SQL commands via the (1) search parameter to index.php, (2) phpcoinsessid parameter to login.php, (3) id, (4) dtopic_id, or (5) dcat_id to mod.php.

CVSS v2.0 NVD

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

2.73% chance of exploitation in the next 30 days, 86th percentile

Published

2005-05-02

Updated

2024-08-07

Proof-of-concept exploits (1)

• http://pridels0.blogspot.com/2006/03/phpcoin-poc.html

ExploitDB entries (2)

• https://www.exploit-db.com/exploits/25569
• https://www.exploit-db.com/exploits/25568

Security advisories

• http://digitalparadox.org/viewadvisories.ah?view=36
• http://www.securityfocus.com/bid/13433

References

• CVE Record
• NVD entry