CVE-2005-4317

Limbo CMS 1.0.4.2 and earlier, with register_globals off, does not protect the $_SERVER variable from external modification, which allows remote attackers to use the _SERVER[REMOTE_ADDR] parameter to (1) conduct cross-site scripting (XSS) attacks in the stats module or (2) execute arbitrary code via an eval injection attack in the wrapper option in index2.php.

• http://rgod.altervista.org/limbo1042_xpl.htmlExploit, Vendor Advisory
• http://secunia.com/advisories/18063/Patch, Vendor Advisory
• http://securityreason.com/securityalert/255
• http://securitytracker.com/id?1015364Exploit
• http://www.osvdb.org/21754
• http://www.osvdb.org/21756
• http://www.securityfocus.com/archive/1/419470/100/0/threaded
• http://www.securityfocus.com/bid/15871/Exploit
• http://www.vupen.com/english/advisories/2005/2932
• http://rgod.altervista.org/limbo1042_xpl.htmlExploit, Vendor Advisory
• http://secunia.com/advisories/18063/Patch, Vendor Advisory
• http://securityreason.com/securityalert/255
• http://securitytracker.com/id?1015364Exploit
• http://www.osvdb.org/21754
• http://www.osvdb.org/21756
• http://www.securityfocus.com/archive/1/419470/100/0/threaded
• http://www.securityfocus.com/bid/15871/Exploit
• http://www.vupen.com/english/advisories/2005/2932

Published

Dec 17, 2005

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2005-4311Cross-site scripting (XSS) vulnerability in DCForum 6.25 and…
• CVE-2005-4312SQL injection vulnerability in index.php in AlmondSoft Almon…
• CVE-2005-4313SQL injection vulnerability in index.php in AlmondSoft Almon…
• CVE-2005-4314Cross-site scripting (XSS) vulnerability in ppcal.cgi in PPC…
• CVE-2005-4315SQL injection vulnerability in the search function in Plexum…
• CVE-2005-4316HP-UX B.11.00, B.11.04, B.11.11, and B.11.23 allows remote a…
• CVE-2005-4318SQL injection vulnerability in index.php in Limbo CMS 1.0.4.…
• CVE-2005-4319Directory traversal vulnerability in index2.php in Limbo CMS…
• CVE-2005-4320Limbo CMS 1.0.4.2 and earlier allows remote attackers to obt…
• CVE-2005-4321The Internet Key Exchange version 1 (IKEv1) implementation i…
• CVE-2005-4322Multiple cross-site scripting (XSS) vulnerabilities in Hitac…
• CVE-2005-4323Unspecified vulnerability in Hitachi Cosminexus Collaboratio…