CVE-2005-4427: SQL Injection

Published Dec 20, 2005

Updated

Multiple SQL injection vulnerabilities in Cerberus Helpdesk allow remote attackers to execute arbitrary SQL commands via the (1) fileid parameter to attachmentsend.php, (2) the $addy variable in emailparser.php, (3) $address variable in emailparser.php, (4) $aaddress variable in structs.php, (5) kbid parameter to cerKnowledgebaseHandler.class.php, (6) queues[] parameter to addressesexport.php, (7) $thread variable to display.php, (8) ticket parameter to displayticketthread.php.

Affected Software

1 affected component

Cerberus Cerberus Helpdesk=2.649

Event History

Dec 20, 2005

CVE Published

11:03 PM

Dec 21, 2005

CVE Published

via MITRE·04:00 AM

Data Sourced

via MITRE·04:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2005-4427?

CVE-2005-4427 has a medium severity rating, indicating a significant risk to affected systems.

How do I fix CVE-2005-4427?

Fixing CVE-2005-4427 involves updating Cerberus Helpdesk to the latest version to mitigate the SQL injection vulnerabilities.

What systems are affected by CVE-2005-4427?

CVE-2005-4427 specifically affects Cerberus Helpdesk version 2.649.

What types of attacks can exploit CVE-2005-4427?

CVE-2005-4427 can be exploited to execute arbitrary SQL commands, leading to unauthorized access to the database.

Who is at risk from CVE-2005-4427?

Organizations using Cerberus Helpdesk version 2.649 are at risk if they do not apply the necessary updates to address the vulnerabilities.