Vulnerability Details : CVE-2005-1384
Multiple SQL injection vulnerabilities in phpCoin 1.2.2 allow remote attackers to execute arbitrary SQL commands via the (1) search parameter to index.php, (2) phpcoinsessid parameter to login.php, (3) id, (4) dtopic_id, or (5) dcat_id to mod.php.
Vulnerability category: Sql Injection
Exploit prediction scoring system (EPSS) score for CVE-2005-1384
Probability of exploitation activity in the next 30 days: 0.97%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 81 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2005-1384
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST |
References for CVE-2005-1384
-
http://securitytracker.com/id?1013834
-
http://marc.info/?l=bugtraq&m=111473522804665&w=2
-
http://www.vupen.com/english/advisories/2005/0423
-
http://pridels0.blogspot.com/2006/03/phpcoin-poc.html
-
http://digitalparadox.org/viewadvisories.ah?view=36
Exploit;Vendor Advisory
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/20308
-
http://www.securityfocus.com/bid/13433
Exploit
Products affected by CVE-2005-1384
- cpe:2.3:a:coinsoft_technologies:phpcoin:1.2:*:*:*:*:*:*:*
- cpe:2.3:a:coinsoft_technologies:phpcoin:1.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:coinsoft_technologies:phpcoin:1.2.1b:*:*:*:*:*:*:*