CVE-2005-0781 SQL injection vulnerability in (1) viewall.php and (2) category.php in paFileDB 3.1 and earlier allows remote attackers to execute arbitrary SQL commands via the start parameter to pafiledb.php.
HighCVSS 7.5
EPSS 2.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
SQL injection vulnerability in (1) viewall.php and (2) category.php in paFileDB 3.1 and earlier allows remote attackers to execute arbitrary SQL commands via the start parameter to pafiledb.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| php arena pafiledb | = 1.1.3 | No fix listed |
| php arena pafiledb | = 2.1.1 | No fix listed |
| php arena pafiledb | = 3.0 | No fix listed |
| php arena pafiledb | = 3.0_beta_3.1 | No fix listed |
| php arena pafiledb | = 3.1 | No fix listed |
References
- 20050312 [SECURITYREASON.COM] SQL injection and XSS in paFileDB mailing-list
- 12788 exploit vdb-entry
- pafiledb-viewall-category-sql-injection(19688) vdb-entry