CVE-2001-1472: SQL Injection

Published Aug 3, 2001

Updated

SQL injection vulnerability in prefs.php in phpBB 1.4.0 and 1.4.1 allows remote authenticated users to execute arbitrary SQL commands and gain administrative access via the viewemail parameter.

Affected Software

2 affected components

Phpbb Group Phpbb=1.4.1

Phpbb Group Phpbb=1.4.0

Event History

Aug 3, 2001

CVE Published

04:00 AM

Apr 21, 2005

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2001-1472?

CVE-2001-1472 is classified as a medium severity vulnerability due to its potential for exploiting SQL injection.

How do I fix CVE-2001-1472?

To fix CVE-2001-1472, upgrade phpBB to a patched version that addresses the SQL injection vulnerability.

Who is affected by CVE-2001-1472?

Users of phpBB versions 1.4.0 and 1.4.1 are affected by CVE-2001-1472.

What type of vulnerability is CVE-2001-1472?

CVE-2001-1472 is an SQL injection vulnerability that allows remote authenticated users to execute arbitrary SQL commands.

What should I do if I cannot upgrade to resolve CVE-2001-1472?

If upgrading is not possible, consider implementing input validation and limiting database privileges to reduce the risk associated with CVE-2001-1472.