CVE-2004-2350: SQL Injection
Published Dec 31, 2004
·Updated
SQL injection vulnerability in search.php for phpBB 1.0 through 2.0.6 allows remote attackers to execute arbitrary SQL and gain privileges via the searchresults parameter.
Affected Software
19 affected components
Phpbb Group Phpbb=2.0.5
Phpbb Group Phpbb=1.2.1
Phpbb Group Phpbb=1.4.1
Phpbb Group Phpbb=1.4.4
Phpbb Group Phpbb=2.0.1
Phpbb Group Phpbb=2.0.3
Phpbb Group Phpbb=2.0_rc2
Phpbb Group Phpbb=1.4.2
Phpbb Group Phpbb=2.0_rc1
Phpbb Group Phpbb=2.0.4
Phpbb Group Phpbb=2.0.2
Phpbb Group Phpbb=1.0.0
Phpbb Group Phpbb=1.2.0
Phpbb Group Phpbb=1.4.0
Phpbb Group Phpbb=2.0_rc4
Phpbb Group Phpbb=2.0.6
Phpbb Group Phpbb=2.0.0
Phpbb Group Phpbb=2.0_rc3
Phpbb Group Phpbb=2.0_beta1
Remediation
Patch Available
Event History
Dec 31, 2004
CVE Published
05:00 AM
Aug 16, 2005
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2004-2350?
The severity of CVE-2004-2350 is classified as high due to the potential for remote attackers to execute arbitrary SQL commands.
2
How do I fix CVE-2004-2350?
To fix CVE-2004-2350, upgrade phpBB to version 2.0.7 or later, which mitigates the SQL injection vulnerability.
3
Which versions of phpBB are affected by CVE-2004-2350?
CVE-2004-2350 affects phpBB versions from 1.0 through 2.0.6.
4
What type of vulnerability is CVE-2004-2350?
CVE-2004-2350 is an SQL injection vulnerability found in the search.php script of phpBB.
5
Can CVE-2004-2350 be exploited remotely?
Yes, CVE-2004-2350 can be exploited remotely, allowing attackers to manipulate database queries.