CVE-2012-2236 SQL injection vulnerability in users.php in PHP Gift Registry 1.5.5 allows remote authenticated users to execute arbitrary SQL commands via the userid parameter in an edit action.

MediumCVSS 6.5 EPSS 0.89%

Published: 2012-04-20 13:00
Updated: 2026-06-17 02:41
Exploit status: No public exploit known

Description

SQL injection vulnerability in users.php in PHP Gift Registry 1.5.5 allows remote authenticated users to execute arbitrary SQL commands via the userid parameter in an edit action.

Affected products

Product	Affected versions	Fixed in
ryan walberg php gift registry	= 1.5.5	No fix listed

References

20120416 Fwd: PHP Gift Registry 1.5.5 SQL Injection exploit mailing-list

CVSS v2.0

6.5 Medium

AV:N/AC:L/Au:S/C:P/I:P/A:P

Access Vector: Network
Access Complexity: Low
Authentication: Single
Confidentiality: Partial
Integrity: Partial
Availability: Partial

Weakness & likelihood

EPSS (exploitation probability, 30 days): 0.89% (percentile 59.8)
CWE: CWE-89

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

PHP Gift Registry 1.5.5 - SQL Injection Exploit · Exploit Database (OffSec) · 2012-02-24