Vulnerabilities > CVE-2005-4227 - Input Validation vulnerability in DCP-Portal
Summary
Multiple "potential" SQL injection vulnerabilities in DCP-Portal 6.1.1 might allow remote attackers to execute arbitrary SQL commands via (1) the password and username parameters in advertiser.php, (2) the aid parameter in announcement.php, (3) the dcp5_member_id, year, agid, day, day_s, hour, minute, month, month_s, and year_s parameters in calendar.php, (4) the cid parameter in contents.php, (5) the dcp5_member_id parameter in forums.php, (6) the bid parameter in go.php, (7) the lid parameter in golink.php, (8) the dcp5_member_id and mid parameters in inbox.php, (9) the catid, dcat, and dl parameters in index.php, (10) the dcp5_member_id in informer.php, (11) the nid parameter in news.php, (12) the type and rate parameters in rate.php, (13) the q parameter in search.php, and (14) the dcp5_member_id in update.php. NOTE: other vectors in the PHP-CHECKER report are also covered by CVE-2005-3365 and CVE-2005-0454.
Vulnerable Configurations
Nessus
NASL family | CGI abuses |
NASL id | DCPPORTAL_SQL.NASL |
description | The remote host is running DCP-Portal, a content management system powered by PHP. The version of DCP-Portal installed on the remote host fails to sanitize user-supplied input to many of its parameters before using it, either in database queries or dynamic web page generation. An attacker may be able to exploit these issues to manipulate such queries to, say, uncover the admin password, launch attacks against the underlying database, and steal authentication cookies. Successful exploitation of the SQL injection flaws requires that PHP |
last seen | 2020-06-01 |
modified | 2020-06-02 |
plugin id | 16478 |
published | 2005-02-16 |
reporter | This script is Copyright (C) 2005-2018 Tenable Network Security, Inc. |
source | https://www.tenable.com/plugins/nessus/16478 |
title | DCP-Portal Multiple Scripts SQL Injection |
code |
|
References
- http://glide.stanford.edu/yichen/research/sec.pdf
- http://secunia.com/advisories/12751
- http://www.osvdb.org/22017
- http://www.osvdb.org/22018
- http://www.osvdb.org/22019
- http://www.osvdb.org/22020
- http://www.osvdb.org/22021
- http://www.osvdb.org/22022
- http://www.osvdb.org/22023
- http://www.osvdb.org/22024
- http://www.osvdb.org/22025
- http://www.osvdb.org/22026
- http://www.osvdb.org/22027
- http://www.osvdb.org/22028
- http://www.osvdb.org/22029
- http://www.osvdb.org/22030
- http://www.osvdb.org/22031
- http://www.securityfocus.com/archive/1/419280/100/0/threaded
- http://www.securityfocus.com/archive/1/419487/100/0/threaded
- http://www.securityfocus.com/bid/15183
- http://www.vupen.com/english/advisories/2005/2863
- https://exchange.xforce.ibmcloud.com/vulnerabilities/22855