CVE-2005-4159: SQL Injection
First published: Sun Dec 11 2005(Updated: )
** DISPUTED ** NOTE: this issue has been disputed by the vendor and third parties. SQL injection vulnerability in Memberlist.php in Simple Machines Forum (SMF) 1.1 rc1 and earlier allows remote attackers to execute arbitrary SQL commands via the start parameter. NOTE: the vendor says that since only one character can be modified, there is no SQL injection. Thus this might be an "invalid SQL syntax error." Multiple followups support the vendor.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Simple Machines Forum | <=1.1_rc1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.securityfocus.com/bid/15791
- http://archives.neohapsis.com/archives/bugtraq/2005-12/0090.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/23546
- http://www.securityfocus.com/archive/1/419535/100/0/threaded
- http://www.securityfocus.com/archive/1/419250/100/0/threaded
- http://www.securityfocus.com/archive/1/419105/100/0/threaded
- http://www.securityfocus.com/archive/1/419068/100/0/threaded
Frequently Asked Questions
What is the severity of CVE-2005-4159?
The severity of CVE-2005-4159 is disputed, but it is categorized as an SQL injection vulnerability that could lead to remote code execution.
How do I fix CVE-2005-4159?
To fix CVE-2005-4159, upgrade your Simple Machines Forum to a version later than 1.1 rc1.
What software is affected by CVE-2005-4159?
CVE-2005-4159 affects Simple Machines Forum version 1.1 rc1 and earlier.
Can CVE-2005-4159 be exploited remotely?
Yes, CVE-2005-4159 can be exploited remotely by attackers to execute arbitrary SQL commands.
Is CVE-2005-4159 still a concern for users of Simple Machines Forum?
While the vulnerability is from 2005, it is still a concern for users who have not updated to a secure version.
- agent/author
- agent/type
- agent/weakness
- agent/references
- agent/severity
- agent/status
- agent/softwarecombine
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/first-publish-date
- agent/event
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- vendor/simple machines
- canonical/simple machines forum
- version/simple machines forum/1.1_rc1
- status/disputed