National Cyber Awareness System

Vulnerability Summary for CVE-2005-4227

Overview

Multiple "potential" SQL injection vulnerabilities in DCP-Portal 6.1.1 might allow remote attackers to execute arbitrary SQL commands via (1) the password and username parameters in advertiser.php, (2) the aid parameter in announcement.php, (3) the dcp5_member_id, year, agid, day, day_s, hour, minute, month, month_s, and year_s parameters in calendar.php, (4) the cid parameter in contents.php, (5) the dcp5_member_id parameter in forums.php, (6) the bid parameter in go.php, (7) the lid parameter in golink.php, (8) the dcp5_member_id and mid parameters in inbox.php, (9) the catid, dcat, and dl parameters in index.php, (10) the dcp5_member_id in informer.php, (11) the nid parameter in news.php, (12) the type and rate parameters in rate.php, (13) the q parameter in search.php, and (14) the dcp5_member_id in update.php. NOTE: other vectors in the PHP-CHECKER report are also covered by CVE-2005-3365 and CVE-2005-0454.

Impact

CVSS Severity (version 2.0 upgrade from v1.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: XF

Name: dcpportal-multiple-php-sql-injection(22855)

Hyperlink:http://xforce.iss.net/xforce/xfdb/22855

External Source: VUPEN

Name: ADV-2005-2863

Hyperlink:http://www.vupen.com/english/advisories/2005/2863

External Source: BID

Name: 15183

Hyperlink:http://www.securityfocus.com/bid/15183

External Source: BUGTRAQ

Name: 20051212 [PHP-CHECKER] 99 potential SQL injection vulnerabilities

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/419487/100/0/threaded

External Source: BUGTRAQ

Name: 20051211 [PHP-CHECKER] 99 potential SQL injection vulnerabilities

Type: Advisory

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/419280/100/0/threaded

External Source: OSVDB

Name: 22031

Hyperlink:http://www.osvdb.org/22031

External Source: OSVDB

Name: 22030

Hyperlink:http://www.osvdb.org/22030

External Source: OSVDB

Name: 22029

Hyperlink:http://www.osvdb.org/22029

External Source: OSVDB

Name: 22028

Hyperlink:http://www.osvdb.org/22028

External Source: OSVDB

Name: 22027

Hyperlink:http://www.osvdb.org/22027

External Source: OSVDB

Name: 22026

Hyperlink:http://www.osvdb.org/22026

External Source: OSVDB

Name: 22025

Hyperlink:http://www.osvdb.org/22025

External Source: OSVDB

Name: 22024

Hyperlink:http://www.osvdb.org/22024

External Source: OSVDB

Name: 22023

Hyperlink:http://www.osvdb.org/22023

External Source: OSVDB

Name: 22022

Hyperlink:http://www.osvdb.org/22022

External Source: OSVDB

Name: 22021

Hyperlink:http://www.osvdb.org/22021

External Source: OSVDB

Name: 22020

Hyperlink:http://www.osvdb.org/22020

External Source: OSVDB

Name: 22019

Hyperlink:http://www.osvdb.org/22019

External Source: OSVDB

Name: 22018

Hyperlink:http://www.osvdb.org/22018

External Source: OSVDB

Name: 22017

Hyperlink:http://www.osvdb.org/22017

External Source: SECUNIA

Name: 12751

Hyperlink:http://secunia.com/advisories/12751

External Source: MISC

Name: http://glide.stanford.edu/yichen/research/sec.pdf

Hyperlink:http://glide.stanford.edu/yichen/research/sec.pdf