CVE-2005-4224: SQL Injection

Published Dec 14, 2005

Updated

Multiple "potential" SQL injection vulnerabilities in e107 0.7 might allow remote attackers to execute arbitrary SQL commands via (1) the email, hideemail, image, realname, signature, timezone, and xupexist parameters in signup.php, (2) the contentcomment, contentrating, and contentsummary parameters in subcontent.php, (3) the downloadcategory and filedemo in upload.php, and (4) the email, hideemail, usertimezone, and userxup parameters in usersettings.php.

Affected Software

1 affected component

e107 e107=0.7

Event History

Dec 14, 2005

CVE Published

11:03 AM

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2005-4224?

CVE-2005-4224 is considered to be potentially critical due to the ability for remote attackers to execute arbitrary SQL commands.

How do I fix CVE-2005-4224?

To fix CVE-2005-4224, it is recommended to update to a newer version of e107 CMS that addresses these SQL injection vulnerabilities.

What parameters are affected by CVE-2005-4224?

CVE-2005-4224 affects several parameters including email, hideemail, image, realname, signature, timezone, and xupexist in signup.php.

Can CVE-2005-4224 lead to a data breach?

Yes, CVE-2005-4224 can potentially lead to a data breach as attackers may execute harmful SQL commands.

Is my website vulnerable to CVE-2005-4224 if I use e107 version 0.7?

Yes, if you are using e107 version 0.7, your website is vulnerable to CVE-2005-4224.