CVE-2005-4227
published 2005-12-14CVE-2005-4227: Multiple "potential" SQL injection vulnerabilities in DCP-Portal 6.1.1 might allow remote attackers to execute arbitrary SQL commands via (1) the password and…
PriorityP335high7.5CVSS 2.0
AVNACLAuNCPIPAP
EPSS
3.13%
86.3th percentile
Multiple "potential" SQL injection vulnerabilities in DCP-Portal 6.1.1 might allow remote attackers to execute arbitrary SQL commands via (1) the password and username parameters in advertiser.php, (2) the aid parameter in announcement.php, (3) the dcp5_member_id, year, agid, day, day_s, hour, minute, month, month_s, and year_s parameters in calendar.php, (4) the cid parameter in contents.php, (5) the dcp5_member_id parameter in forums.php, (6) the bid parameter in go.php, (7) the lid parameter in golink.php, (8) the dcp5_member_id and mid parameters in inbox.php, (9) the catid, dcat, and dl parameters in index.php, (10) the dcp5_member_id in informer.php, (11) the nid parameter in news.php, (12) the type and rate parameters in rate.php, (13) the q parameter in search.php, and (14) the dcp5_member_id in update.php. NOTE: other vectors in the PHP-CHECKER report are also covered by CVE-2005-3365 and CVE-2005-0454.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| codeworx_technologies | dcp-portal | — | — |
| codeworx_technologies | dcp-portal | — | — |
| codeworx_technologies | dcp-portal | — | — |
| codeworx_technologies | dcp-portal | — | — |
| codeworx_technologies | dcp-portal | — | — |
| codeworx_technologies | dcp-portal | — | — |
| codeworx_technologies | dcp-portal | — | — |
| codeworx_technologies | dcp-portal | — | — |
| codeworx_technologies | dcp-portal | — | — |
| codeworx_technologies | dcp-portal | — | — |
| codeworx_technologies | dcp-portal | — | — |
| codeworx_technologies | dcp-portal | — | — |
| codeworx_technologies | dcp-portal | — | — |
| codeworx_technologies | dcp-portal | — | — |
| codeworx_technologies | dcp-portal | — | — |
| codeworx_technologies | dcp-portal | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-x7w2-7973-vvmw: SQL injection vulnerability in login
ghsa_unreviewed·2022-05-01·CVSS 7.5
CVE-2006-4836 [HIGH] GHSA-x7w2-7973-vvmw: SQL injection vulnerability in login
SQL injection vulnerability in login.php in DCP-Portal SE 6.0 allows remote attackers to execute arbitrary SQL commands via the username parameter. NOTE: The lostpassword.php and calendar.php vectors are already covered by CVE-2005-3365, and the search.php vector is already covered by CVE-2005-4227.
GHSA
GHSA-97m8-rj8m-hvm2: Multiple "potential" SQL injection vulnerabilities in DCP-Portal 6
ghsa_unreviewed·2022-05-01·CVSS 7.5
CVE-2005-4227 [HIGH] GHSA-97m8-rj8m-hvm2: Multiple "potential" SQL injection vulnerabilities in DCP-Portal 6
Multiple "potential" SQL injection vulnerabilities in DCP-Portal 6.1.1 might allow remote attackers to execute arbitrary SQL commands via (1) the password and username parameters in advertiser.php, (2) the aid parameter in announcement.php, (3) the dcp5_member_id, year, agid, day, day_s, hour, minute, month, month_s, and year_s parameters in calendar.php, (4) the cid parameter in contents.php, (5) the dcp5_member_id parameter in forums.php, (6) the bid parameter in go.php, (7) the lid parameter in golink.php, (8) the dcp5_member_id and mid parameters in inbox.php, (9) the catid, dcat, and dl parameters in index.php, (10) the dcp5_member_id in informer.php, (11) the nid parameter in news.php, (12) the type and rate parameters in rate.php, (13) the q parameter in search.php, and (14) the dcp
GHSA
GHSA-88h7-xm9m-w3q6: Multiple cross-site scripting (XSS) vulnerabilities in DCP-Portal 5
ghsa_unreviewed·2022-05-01·CVSS 7.5
CVE-2006-0220 [HIGH] GHSA-88h7-xm9m-w3q6: Multiple cross-site scripting (XSS) vulnerabilities in DCP-Portal 5
Multiple cross-site scripting (XSS) vulnerabilities in DCP-Portal 5.3 through 6.1.1 allow remote attackers to inject arbitrary web script or HTML via (1) the day parameter in calendar.php and (2) the input form in search.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. It is possible that this issue is resultant from an SQL injection problem in CVE-2005-4227.3 and CVE-2005-4227.13.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://glide.stanford.edu/yichen/research/sec.pdfhttp://secunia.com/advisories/12751http://www.osvdb.org/22017http://www.osvdb.org/22018http://www.osvdb.org/22019http://www.osvdb.org/22020http://www.osvdb.org/22021http://www.osvdb.org/22022http://www.osvdb.org/22023http://www.osvdb.org/22024http://www.osvdb.org/22025http://www.osvdb.org/22026http://www.osvdb.org/22027http://www.osvdb.org/22028http://www.osvdb.org/22029http://www.osvdb.org/22030http://www.osvdb.org/22031http://www.securityfocus.com/archive/1/419280/100/0/threadedhttp://www.securityfocus.com/archive/1/419487/100/0/threadedhttp://www.securityfocus.com/bid/15183http://www.vupen.com/english/advisories/2005/2863https://exchange.xforce.ibmcloud.com/vulnerabilities/22855http://glide.stanford.edu/yichen/research/sec.pdfhttp://secunia.com/advisories/12751http://www.osvdb.org/22017http://www.osvdb.org/22018http://www.osvdb.org/22019http://www.osvdb.org/22020http://www.osvdb.org/22021http://www.osvdb.org/22022http://www.osvdb.org/22023http://www.osvdb.org/22024http://www.osvdb.org/22025http://www.osvdb.org/22026http://www.osvdb.org/22027http://www.osvdb.org/22028http://www.osvdb.org/22029http://www.osvdb.org/22030http://www.osvdb.org/22031http://www.securityfocus.com/archive/1/419280/100/0/threadedhttp://www.securityfocus.com/archive/1/419487/100/0/threadedhttp://www.securityfocus.com/bid/15183http://www.vupen.com/english/advisories/2005/2863https://exchange.xforce.ibmcloud.com/vulnerabilities/22855
2005-12-14
Published