CVE-2005-3019 Multiple SQL injection vulnerabilities in vBulletin before 3.0.9 allow remote attackers to execute arbitrary SQL commands via the (1) request parameter to joinrequests.php, (2) limitnumber or (3) limi...
HighCVSS 7.5
EPSS 3.9%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple SQL injection vulnerabilities in vBulletin before 3.0.9 allow remote attackers to execute arbitrary SQL commands via the (1) request parameter to joinrequests.php, (2) limitnumber or (3) limitstart to user.php, (4) usertitle.php, or (5) usertools.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jelsoft vbulletin | = 1.0.1 | No fix listed |
| jelsoft vbulletin | = 2.0.3 | No fix listed |
| jelsoft vbulletin | = 2.0_rc2 | No fix listed |
| jelsoft vbulletin | = 2.0_rc3 | No fix listed |
| jelsoft vbulletin | = 2.2.0 | No fix listed |
| jelsoft vbulletin | = 2.2.1 | No fix listed |
| jelsoft vbulletin | = 2.2.2 | No fix listed |
| jelsoft vbulletin | = 2.2.3 | No fix listed |
| jelsoft vbulletin | = 2.2.4 | No fix listed |
| jelsoft vbulletin | = 2.2.5 | No fix listed |
| jelsoft vbulletin | = 2.2.6 | No fix listed |
| jelsoft vbulletin | = 2.2.7 | No fix listed |
| jelsoft vbulletin | = 2.2.8 | No fix listed |
| jelsoft vbulletin | = 2.2.9 | No fix listed |
| jelsoft vbulletin | = 2.3.0 | No fix listed |
| jelsoft vbulletin | = 2.3.2 | No fix listed |
| jelsoft vbulletin | = 2.3.3 | No fix listed |
| jelsoft vbulletin | = 2.3.4 | No fix listed |
| jelsoft vbulletin | = 3.0 | No fix listed |
| jelsoft vbulletin | = 3.0.1 | No fix listed |
| jelsoft vbulletin | = 3.0.2 | No fix listed |
| jelsoft vbulletin | = 3.0.3 | No fix listed |
| jelsoft vbulletin | = 3.0.4 | No fix listed |
| jelsoft vbulletin | = 3.0.5 | No fix listed |
| jelsoft vbulletin | = 3.0.6 | No fix listed |
Show 9 more
| Product | Affected versions | Fixed in |
|---|---|---|
| jelsoft vbulletin | = 3.0.7 | No fix listed |
| jelsoft vbulletin | = 3.0.8 | No fix listed |
| jelsoft vbulletin | = 3.0_beta_2 | No fix listed |
| jelsoft vbulletin | = 3.0_beta_3 | No fix listed |
| jelsoft vbulletin | = 3.0_beta_4 | No fix listed |
| jelsoft vbulletin | = 3.0_beta_5 | No fix listed |
| jelsoft vbulletin | = 3.0_beta_6 | No fix listed |
| jelsoft vbulletin | = 3.0_beta_7 | No fix listed |
| jelsoft vbulletin | = 3.0_gamma | No fix listed |
References
- 20050918 [BuHa-Security] Multiple vulnerabilities in (admincp/modcp of) mailing-list
- morph3us.org exploit patch vendor-advisory
- 16873 patch third-party-advisory vendor-advisory
- 14872 exploit patch vdb-entry
- vbulletin-multiple-script-sql-injection(22323) vdb-entry