CVE-2005-4159
- State
- Published
- Severity
- Not scored
- Published
- Dec 11, 2005
- Updated
- Aug 7, 2024
- Reserved
- Dec 11, 2005
Description
NOTE: this issue has been disputed by the vendor and third parties. SQL injection vulnerability in Memberlist.php in Simple Machines Forum (SMF) 1.1 rc1 and earlier allows remote attackers to execute arbitrary SQL commands via the start parameter. NOTE: the vendor says that since only one character can be modified, there is no SQL injection. Thus this might be an "invalid SQL syntax error." Multiple followups support the vendor
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- 20051213 Re: Re: Re: [KAPDA::#16] - SMF SQL Injectionmailing-list
- 15791vdb-entry
- 20051211 Re: Re: [KAPDA::#16] - SMF SQL Injectionmailing-list
- smf-memberlist-sql-injection(23546)vdb-entry
- 20051209 [KAPDA::#16] - SMF SQL Injectionmailing-list
- 20051209 SMF SQL Injectionmailing-list
- 20051210 Re: [KAPDA::#16] - SMF SQL Injectionmailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.