CVE-2004-1949: SQL Injection

Published Dec 31, 2004

Updated

SQL injection vulnerability in PostNuke 7.2.6 and earlier allows remote attackers to execute arbitrary SQL via (1) the sif parameter to index.php in the Comments module or (2) timezoneoffset parameter to changeinfo.php in the YourAccount module.

Affected Software

1 affected component

Postnuke Software Foundation Postnuke=0.726

Remediation

Patch Available

http://www.securityfocus.com/bid/10146

Event History

Dec 31, 2004

CVE Published

05:00 AM

May 10, 2005

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2004-1949?

CVE-2004-1949 is considered a critical severity vulnerability due to its ability to allow remote attackers to execute arbitrary SQL commands.

How do I fix CVE-2004-1949?

To fix CVE-2004-1949, upgrade PostNuke to version 7.2.7 or later, where this vulnerability is patched.

What software is affected by CVE-2004-1949?

CVE-2004-1949 affects PostNuke versions 7.2.6 and earlier.

What type of vulnerability is CVE-2004-1949?

CVE-2004-1949 is an SQL injection vulnerability, which allows attackers to manipulate SQL queries.

What are the potential impacts of exploiting CVE-2004-1949?

Exploiting CVE-2004-1949 can lead to unauthorized access to the database, data manipulation, and complete system compromise.