CVE-2005-4195
Last modified
CVE-2005-4195 is a vulnerability of currently unknown severity. Multiple SQL injection vulnerabilities in Scout Portal Toolkit (SPT) 1.3.1 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the ParentId parameter in SPT--BrowseResources.php, (2) ResourceId parameter in SPT--FullRecord.php, (3) ResourceOffset parameter in SPT--Home.php, and (4) F_UserName and (5) F_Password in SPT--UserLogin.php. NOTE: it was later reported that vector 1 is also present in 1.4.0.. EPSS estimates a 5.50% chance of exploitation in the next 30 days.
Description
Multiple SQL injection vulnerabilities in Scout Portal Toolkit (SPT) 1.3.1 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the ParentId parameter in SPT--BrowseResources.php, (2) ResourceId parameter in SPT--FullRecord.php, (3) ResourceOffset parameter in SPT--Home.php, and (4) F_UserName and (5) F_Password in SPT--UserLogin.php. NOTE: it was later reported that vector 1 is also present in 1.4.0.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Internet Scout | Scout Portal Toolkit | <= 1.3.1 |
| Internet Scout | Scout Portal Toolkit | 1.3.0_beta |
| Internet Scout Project | Scout Portal Toolkit | 1.4.0 |
References
- http://secunia.com/advisories/17979Vendor Advisory
- http://www.vupen.com/english/advisories/2005/2844Vendor Advisory
- http://secunia.com/advisories/17979Vendor Advisory
- http://www.vupen.com/english/advisories/2005/2844Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2005-4195?
How severe is CVE-2005-4195?
How do I fix CVE-2005-4195?
Are you affected by CVE-2005-4195?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST