CVE-2005-2474
First published: Fri Aug 05 2005(Updated: )
ChurchInfo allows remote attackers to execute obtain sensitive information via the PersonID parameter to (1) PersonView.php, (2) MemberRoleChange.php, (3) PropertyAssign.php, (4) WhyCameEditor.php, (5) GroupPropsEditor.php, (6) Reports/PDFLabel.php, or (7) UserDelete.php, an invalid Number parameter to (8) SelectList.php or (9) SelectDelete.php, GroupID parameter to (10) GroupView.php, (11) GroupMemberList.php, (12) MemberRoleChange.php, (13) GroupDelete.php, (14) /Reports/ClassAttendance.php, or (15) /Reports/GroupReport.php, (16) PropertyID parameter to PropertyEditor.php, FamilyID parameter to (17) Canvas05Editor.php, (18) CanvasEditor.php, or (19) FamilyView.php, or (20) PledgeID parameter to PledgeDetails.php, which reveal the path in an error message.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Church Management System | =1.1.1 | |
| Church Management System | =1.1.2 | |
| Church Management System | =1.1.3 | |
| Church Management System | =1.1.4 | |
| Church Management System | =1.1.5 | |
| Church Management System | =1.1.6 | |
| Church Management System | =1.2.0 | |
| Church Management System | =1.2.1 | |
| Church Management System | =1.2.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.osvdb.org/18429
- http://www.osvdb.org/18430
- http://www.osvdb.org/18431
- http://www.osvdb.org/18432
- http://www.osvdb.org/18433
- http://www.osvdb.org/18434
- http://www.osvdb.org/18435
- http://www.osvdb.org/18436
- http://www.osvdb.org/18437
- http://www.osvdb.org/18438
- http://www.osvdb.org/18439
- http://www.osvdb.org/18450
- http://securitytracker.com/id?1014617
- http://secunia.com/advisories/16292
- http://www.osvdb.org/18425
- http://www.osvdb.org/18426
- http://marc.info/?l=bugtraq&m=112291550713546&w=2
- https://exchange.xforce.ibmcloud.com/vulnerabilities/21648
Frequently Asked Questions
What is the severity of CVE-2005-2474?
CVE-2005-2474 is classified as a medium severity vulnerability due to its potential to expose sensitive information.
How do I fix CVE-2005-2474?
To fix CVE-2005-2474, it is recommended to upgrade to ChurchInfo version 1.2.3 or later, as these versions contain patches for this vulnerability.
Which versions of ChurchInfo are affected by CVE-2005-2474?
CVE-2005-2474 affects ChurchInfo versions 1.1.1 through 1.2.2.
What type of attack is possible with CVE-2005-2474?
CVE-2005-2474 allows remote attackers to execute techniques that lead to the exposure of sensitive information via manipulated parameters.
Can CVE-2005-2474 be exploited remotely?
Yes, CVE-2005-2474 can be exploited remotely due to the vulnerabilities present in the specified PHP scripts.
- agent/first-publish-date
- agent/type
- agent/references
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/author
- agent/severity
- agent/event
- agent/description
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-historical
- vendor/churchinfo
- canonical/church management system
- version/church management system/1.1.1
- version/church management system/1.1.2
- version/church management system/1.1.3
- version/church management system/1.1.4
- version/church management system/1.1.5
- version/church management system/1.1.6
- version/church management system/1.2.0
- version/church management system/1.2.1
- version/church management system/1.2.2