CVE-2005-3022 — SQL Injection in Vbulletin

CWE-89 — SQL Injection5 documents3 sources
Severity
7.5HIGHNVD
NVD6.5
EPSS
0.5%
top 33.24%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Jelsoft VbulletinVbulletin
Timeline
PublishedSep 21
Latest updateMay 14

Description

Multiple SQL injection vulnerabilities in vBulletin 3.0.9 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) announcement parameter to announcement.php, (2) userid parameter to user.php, (3) calendar parameter to admincalendar.php, (4) cronid parameter to cronlog.php, (5) usergroupid parameter to email.php, (6) help parameter to help.php, (7) rvt parameter to language.php, (8) keep parameter to phrase.php, or (9) updateprofilepic parameter to usertools.php.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages2 packages

▶NVDjelsoft/vbulletin35 versions+34

🔴Vulnerability Details

2
GHSA
GHSA-52gf-v954-cv76: SQL injection vulnerability in admincp/admincalendar↗2022-05-14
▶
GHSA
GHSA-ppw8-45pr-787p: Multiple SQL injection vulnerabilities in vBulletin 3↗2022-05-01
▶

💥Exploits & PoCs

1
Exploit-DB
Microsoft Windows - ASN.1 Remote (MS04-007)↗2004-03-26
▶