CVE-2005-0661: SQL Injection

Published Mar 7, 2005

Updated

SQL injection vulnerability in the getwbbuserdata function in session.php for Woltlab Burning Board 2.0.3 through 2.3.0 allows remote attackers to execute arbitrary SQL commands via the (1) userid or (2) lastvisit cookie.

Affected Software

4 affected components

WoltLab Burning Board=2.2.1

WoltLab Burning Board=2.1.5

WoltLab Burning Board=2.3.0

WoltLab Burning Board=2.0.3

Remediation

Patch Available

http://secunia.com/advisories/14450

Event History

Mar 7, 2005

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2005-0661?

CVE-2005-0661 has a high severity rating due to the potential for remote SQL command execution.

How do I fix CVE-2005-0661?

To fix CVE-2005-0661, upgrade to a version of Woltlab Burning Board that is not vulnerable, specifically versions above 2.3.0.

Which versions of Woltlab Burning Board are affected by CVE-2005-0661?

The versions of Woltlab Burning Board affected by CVE-2005-0661 are 2.0.3 through 2.3.0.

Can CVE-2005-0661 be exploited remotely?

Yes, CVE-2005-0661 can be exploited remotely if an attacker sends manipulated requests containing SQL commands.

What are the potential impacts of exploiting CVE-2005-0661?

Exploitation of CVE-2005-0661 can lead to unauthorized access to the database and execution of arbitrary SQL commands.