CVE-2005-4140 SQL injection vulnerability in admin/login/index.php in Website Baker 2.6.0 allows remote attackers to execute arbitrary SQL commands via the username parameter, as used by the user field.
HighCVSS 7.5
EPSS 2.2%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
SQL injection vulnerability in admin/login/index.php in Website Baker 2.6.0 allows remote attackers to execute arbitrary SQL commands via the username parameter, as used by the user field.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| website baker | = 2.5.2 | No fix listed |
| website baker | = 2.6 | No fix listed |
References
- 20051208 Website Baker <=2.6.0 SQL Injection -> Login bypass -> remote code execution mailing-list
- rgod.altervista.org
- 17945 third-party-advisory
- 244 third-party-advisory
- 1015335 vdb-entry
- 21572 vdb-entry
- 20051212 Re: Website Baker <=2.6.0 SQL Injection -> Login bypass -> remote code execution mailing-list
- 15776 exploit vdb-entry
- ADV-2005-2818 vdb-entry