CVE-2004-2754: SQL Injection
Published Dec 31, 2004
·Updated
SQL injection vulnerability in SSI.php in YaBB SE 1.5.4, 1.5.3, and possibly other versions before 1.5.5 allows remote attackers to execute arbitrary SQL commands via the IDMEMBER parameter to the (1) recentTopics and (2) welcome functions.
Affected Software
9 affected components
Yabb YaBB SE=1.5.0
Yabb YaBB SE=1.1.3
Yabb YaBB SE=1.4.1
Yabb YaBB SE=1.5.1_rc1
Yabb YaBB SE=1.5.4
Yabb YaBB SE=0.8
Yabb YaBB SE=1.5.1
Yabb YaBB SE=1.5.2
Yabb YaBB SE=1.5.3
Remediation
Patch Available
Event History
Dec 31, 2004
CVE Published
05:00 AM
Nov 16, 2007
CVE Published
via MITRE·04:00 AM
Data Sourced
via MITRE·04:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2004-2754?
CVE-2004-2754 has a moderate severity level due to the potential for remote SQL command execution.
2
How do I fix CVE-2004-2754?
To fix CVE-2004-2754, upgrade YaBB SE to version 1.5.5 or later.
3
Which versions are affected by CVE-2004-2754?
CVE-2004-2754 affects YaBB SE versions 1.5.0, 1.5.1, 1.5.2, 1.5.3, 1.5.4, and earlier versions.
4
What type of vulnerability is CVE-2004-2754?
CVE-2004-2754 is an SQL injection vulnerability.
5
Can CVE-2004-2754 be exploited remotely?
Yes, CVE-2004-2754 can be exploited remotely by attackers to execute arbitrary SQL commands.