CVE-2005-2113: SQL Injection

Published Jul 1, 2005

Updated

SQL injection vulnerability in the loginUser function in the XMLRPC server in XOOPS 2.0.11 and earlier allows remote attackers to execute arbitrary SQL commands and bypass authentication via crafted values in an XML file, as demonstrated using the blogger.getPost method.

Affected Software

15 affected components

Xoops Xoops=2.0.5.1

Xoops Xoops=2.0.2

Xoops Xoops=2.0.5.2

Xoops Xoops=2.0.9.2

Xoops Xoops=2.0.7

Xoops Xoops=2.0.3

Xoops Xoops=2.0.9

Xoops Xoops=2.0.4

Xoops Xoops=2.0.1

Xoops Xoops=2.0.10

Xoops Xoops=2.0.11

Xoops Xoops=2.0

Xoops Xoops=2.0.5

Xoops Xoops=2.0.9.3

Xoops Xoops=2.0.6

Remediation

Patch Available

http://www.xoops.org/modules/news/article.php?storyid=2383

Event History

Jul 1, 2005

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2005-2113?

CVE-2005-2113 is classified as a critical severity vulnerability due to the potential for unauthorized access and arbitrary SQL command execution.

How do I fix CVE-2005-2113?

To fix CVE-2005-2113, you should upgrade to XOOPS version 2.0.12 or later which addresses this SQL injection vulnerability.

What versions of XOOPS are affected by CVE-2005-2113?

CVE-2005-2113 affects XOOPS versions 2.0.11 and earlier, including 2.0.10 and prior versions.

What type of vulnerability is CVE-2005-2113?

CVE-2005-2113 is an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands.

Can CVE-2005-2113 lead to data breaches?

Yes, CVE-2005-2113 can potentially lead to data breaches by allowing attackers to bypass authentication and access sensitive information.