CVE-2005-1948: SQL Injection

Published Jun 9, 2005

Updated

Multiple SQL injection vulnerabilities in Invision Gallery before 1.3.1 allow remote attackers to execute arbitrary SQL commands via (1) the comment parameter in an editcomment action or (2) the rating parameter when voting on a photo.

Affected Software

2 affected components

Invision Power Services Invision Gallery=1.0.1

Invision Power Services Invision Gallery=1.3

Remediation

Patch Available

http://www.gulftech.org/?node=research&article_id=00079-06092005

Event History

Jun 9, 2005

CVE Published

04:00 AM

Jun 14, 2005

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2005-1948?

CVE-2005-1948 is classified as a medium severity vulnerability due to its potential for SQL injection attacks.

How do I fix CVE-2005-1948?

To fix CVE-2005-1948, upgrade Invision Gallery to version 1.3.1 or later, which patches the SQL injection vulnerabilities.

What type of vulnerability is CVE-2005-1948?

CVE-2005-1948 is an SQL injection vulnerability that allows attackers to execute arbitrary SQL commands.

What versions of Invision Gallery are affected by CVE-2005-1948?

CVE-2005-1948 affects Invision Gallery versions 1.0.1 and 1.3 before version 1.3.1.

Can CVE-2005-1948 lead to data compromise?

Yes, CVE-2005-1948 can lead to data compromise as it allows unauthorized SQL commands that may expose or manipulate sensitive data.