CVE-2005-4225: SQL Injection
Multiple "potential" SQL injection vulnerabilities in myBloggie 2.1.3 beta might allow remote attackers to execute arbitrary SQL commands via (1) the category parameter in add.php, (2) the catdesc parameter in addcat.php, (3) the level and user parameters in adduser.php, (4) the postid parameter in del.php, (5) the catid parameter in delcat.php, (6) the commentid parameter in delcomment.php, (7) the id parameter in deluser.php, (8) the postid and category parameter in edit.php, (9) the catid and catdesc parameters in editcat.php, and (10) the id, level, and user parameters in edituser.php. NOTE: the username/login.php vector is already identified by CVE-2005-2838.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2005-4225?
CVE-2005-4225 has a medium severity rating due to the potential for SQL injection attacks.
How do I fix CVE-2005-4225?
To fix CVE-2005-4225, upgrade myBloggie to a version that resolves these vulnerabilities.
What components of myBloggie are affected by CVE-2005-4225?
CVE-2005-4225 affects the add.php, addcat.php, and adduser.php components in myBloggie 2.1.3 beta.
Can CVE-2005-4225 lead to data breaches?
Yes, CVE-2005-4225 can allow remote attackers to execute arbitrary SQL commands, potentially leading to data breaches.
Who can exploit CVE-2005-4225?
Remote attackers with the ability to manipulate the vulnerable parameters in myBloggie 2.1.3 beta can exploit CVE-2005-4225.