CVE-2011-1546 Multiple SQL injection vulnerabilities in Andy's PHP Knowledgebase (Aphpkb) before 0.95.3 allow remote attackers to execute arbitrary SQL commands via the s parameter to (1) a_viewusers.php or (2) key...
HighCVSS 7.5
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple SQL injection vulnerabilities in Andy's PHP Knowledgebase (Aphpkb) before 0.95.3 allow remote attackers to execute arbitrary SQL commands via the s parameter to (1) a_viewusers.php or (2) keysearch.php; and allow remote authenticated administrators to execute arbitrary SQL commands via the (3) id or (4) start parameter to pending.php, or the (5) aid parameter to a_authordetails.php. NOTE: some of these details are obtained from third party information.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| aphpkb | <= 0.95.2 | No fix listed |
| aphpkb | = 0.1 | No fix listed |
| aphpkb | = 0.2 | No fix listed |
| aphpkb | = 0.3 | No fix listed |
| aphpkb | = 0.4 | No fix listed |
| aphpkb | = 0.5 | No fix listed |
| aphpkb | = 0.6 | No fix listed |
| aphpkb | = 0.9 | No fix listed |
| aphpkb | = 0.21 | No fix listed |
| aphpkb | = 0.31 | No fix listed |
| aphpkb | = 0.33 | No fix listed |
| aphpkb | = 0.35 | No fix listed |
| aphpkb | = 0.38 | No fix listed |
| aphpkb | = 0.39 | No fix listed |
| aphpkb | = 0.41 | No fix listed |
| aphpkb | = 0.42 | No fix listed |
| aphpkb | = 0.43 | No fix listed |
| aphpkb | = 0.44 | No fix listed |
| aphpkb | = 0.45 | No fix listed |
| aphpkb | = 0.51 | No fix listed |
| aphpkb | = 0.52 | No fix listed |
| aphpkb | = 0.53 | No fix listed |
| aphpkb | = 0.54 | No fix listed |
| aphpkb | = 0.55 | No fix listed |
| aphpkb | = 0.56 | No fix listed |
Show 67 more
| Product | Affected versions | Fixed in |
|---|---|---|
| aphpkb | = 0.57 | No fix listed |
| aphpkb | = 0.58 | No fix listed |
| aphpkb | = 0.59 | No fix listed |
| aphpkb | = 0.61 | No fix listed |
| aphpkb | = 0.62 | No fix listed |
| aphpkb | = 0.63 | No fix listed |
| aphpkb | = 0.64 | No fix listed |
| aphpkb | = 0.65 | No fix listed |
| aphpkb | = 0.66 | No fix listed |
| aphpkb | = 0.67 | No fix listed |
| aphpkb | = 0.70 | No fix listed |
| aphpkb | = 0.71 | No fix listed |
| aphpkb | = 0.72 | No fix listed |
| aphpkb | = 0.73 | No fix listed |
| aphpkb | = 0.74 | No fix listed |
| aphpkb | = 0.75 | No fix listed |
| aphpkb | = 0.76 | No fix listed |
| aphpkb | = 0.77 | No fix listed |
| aphpkb | = 0.78 | No fix listed |
| aphpkb | = 0.79 | No fix listed |
| aphpkb | = 0.80 | No fix listed |
| aphpkb | = 0.81 | No fix listed |
| aphpkb | = 0.82 | No fix listed |
| aphpkb | = 0.83 | No fix listed |
| aphpkb | = 0.84 | No fix listed |
| aphpkb | = 0.85 | No fix listed |
| aphpkb | = 0.86 | No fix listed |
| aphpkb | = 0.87 | No fix listed |
| aphpkb | = 0.88 | No fix listed |
| aphpkb | = 0.88.5 | No fix listed |
| aphpkb | = 0.88.6 | No fix listed |
| aphpkb | = 0.88.7 | No fix listed |
| aphpkb | = 0.88.8 | No fix listed |
| aphpkb | = 0.89 | No fix listed |
| aphpkb | = 0.91 | No fix listed |
| aphpkb | = 0.92 | No fix listed |
| aphpkb | = 0.92.1 | No fix listed |
| aphpkb | = 0.92.2 | No fix listed |
| aphpkb | = 0.92.3 | No fix listed |
| aphpkb | = 0.92.4 | No fix listed |
| aphpkb | = 0.92.5 | No fix listed |
| aphpkb | = 0.92.6 | No fix listed |
| aphpkb | = 0.92.7 | No fix listed |
| aphpkb | = 0.92.8 | No fix listed |
| aphpkb | = 0.92.9 | No fix listed |
| aphpkb | = 0.93.1 | No fix listed |
| aphpkb | = 0.93.2 | No fix listed |
| aphpkb | = 0.93.3 | No fix listed |
| aphpkb | = 0.93.4 | No fix listed |
| aphpkb | = 0.93.5 | No fix listed |
| aphpkb | = 0.93.6 | No fix listed |
| aphpkb | = 0.93.7 | No fix listed |
| aphpkb | = 0.93.8 | No fix listed |
| aphpkb | = 0.93.9 | No fix listed |
| aphpkb | = 0.94.1 | No fix listed |
| aphpkb | = 0.94.2 | No fix listed |
| aphpkb | = 0.94.3 | No fix listed |
| aphpkb | = 0.94.4 | No fix listed |
| aphpkb | = 0.94.5 | No fix listed |
| aphpkb | = 0.94.6 | No fix listed |
| aphpkb | = 0.94.7 | No fix listed |
| aphpkb | = 0.94.8 | No fix listed |
| aphpkb | = 0.94.9 | No fix listed |
| aphpkb | = 0.95 | No fix listed |
| aphpkb | = 0.95.1 | No fix listed |
| aphpkb | = 0.361 | No fix listed |
| aphpkb | = 0.371 | No fix listed |
References
- aphpkb.blogspot.com patch
- 34476 third-party-advisory vendor-advisory
- 8168 third-party-advisory
- 8172 third-party-advisory
- 17084 exploit
- 20110330 'Andy's PHP Knowledgebase' SQL Injection Vulnerability (CVE-2011-1546) mailing-list
- 47097 exploit vdb-entry
- www.uncompiled.com exploit
- ADV-2011-0802 vdb-entry vendor-advisory
- aphpkb-aviewusers-sql-injection(66500) vdb-entry