CVE-2004-2695: SQL Injection

Published Dec 31, 2004

Updated

SQL injection vulnerability in the Authorize.net callback code (subscriptions/authorize.php) in Jelsoft vBulletin 3.0 through 3.0.3 allows remote attackers to execute arbitrary SQL statements via the xinvoicenum parameter. NOTE: this issue might be related to CVE-2006-4267.

Affected Software

12 affected components

Jelsoft vBulletin=3.0_beta_6

Jelsoft vBulletin=3.0.1

Jelsoft vBulletin=3.0_beta_7

Jelsoft vBulletin=3.0_beta_3

Jelsoft vBulletin=3.0_beta_2

Jelsoft vBulletin=3.0.2

Jelsoft vBulletin=3.0_gamma

Jelsoft vBulletin=3.0_beta_4

Jelsoft vBulletin=3.0.3

Jelsoft vBulletin=3.0

Jelsoft vBulletin=3.0_beta_5

Point-to-point Protocol Project Point-to-point Protocol=2.4.1

Remediation

Patch Available

http://www.vbulletin.com/forum/bugs.php?do=view&bugid=3379

Event History

Dec 31, 2004

CVE Published

05:00 AM

Oct 7, 2007

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2004-2695?

CVE-2004-2695 has a moderate severity rating due to the potential for remote SQL injection attacks.

How do I fix CVE-2004-2695?

To fix CVE-2004-2695, upgrade to a version of vBulletin later than 3.0.3, which includes patches for this vulnerability.

Which versions of vBulletin are affected by CVE-2004-2695?

CVE-2004-2695 affects vBulletin versions 3.0 through 3.0.3, along with several beta releases.

Can CVE-2004-2695 be exploited remotely?

Yes, CVE-2004-2695 can be exploited remotely by attackers through the x_invoice_num parameter.

Is CVE-2004-2695 related to any other vulnerabilities?

CVE-2004-2695 may be related to CVE-2006-4267, which also involves SQL injection in vBulletin.