CVE-2005-1596

CriticalCVSS 10.0/10Last modified Jun 16, 2026

Description

index.php in Fusion SBX 1.2 and earlier does not properly use the extract function, which allows remote attackers to bypass authentication by setting the is_logged parameter or execute arbitrary code via the maxname2 parameter.

Metrics

CVSS 2.0 10.0/10AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/15257Patch, Vendor Advisory
http://www.exploits.co.in/Article1134.htmlExploit, Vendor Advisory, URL Repurposed
http://www.osvdb.org/16216Vendor Advisory
http://www.osvdb.org/16217Vendor Advisory
http://www.securiteam.com/exploits/5OP042KFPU.htmlExploit, Vendor Advisory
http://www.vupen.com/english/advisories/2005/0508
https://exchange.xforce.ibmcloud.com/vulnerabilities/20531
http://secunia.com/advisories/15257Patch, Vendor Advisory
http://www.exploits.co.in/Article1134.htmlExploit, Vendor Advisory, URL Repurposed
http://www.osvdb.org/16216Vendor Advisory
http://www.osvdb.org/16217Vendor Advisory
http://www.securiteam.com/exploits/5OP042KFPU.htmlExploit, Vendor Advisory
http://www.vupen.com/english/advisories/2005/0508
https://exchange.xforce.ibmcloud.com/vulnerabilities/20531

Timeline

Published: May 16, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2005

CVE-2005-15974.3Cross-site scripting (XSS) vulnerability in (1) search.php and (2) topics.php for Invision Power Board (IPB) 2.0.3 and earlier allows remote CVE-2005-15987.5SQL injection vulnerability in Invision Power Board (IPB) 2.0.3 and earlier allows remote attackers to execute arbitrary SQL commands via a CVE-2005-15994.3Cross-site scripting (XSS) vulnerability in Kryloff Technologies Subject Search Server (SSServer) 1.1 allows remote attackers to inject arbi CVE-2005-16007.5A "mathematical flaw" in the implementation of the El Gamal signature algorithm for LibTomCrypt 1.0 to 1.0.2 allows attackers to generate va CVE-2005-16015.0MRO Maximo Self Service 4 and 5 stores certain information under the web document root using file extensions that are not processed by Tomca CVE-2005-16027.5SQL injection vulnerability in login.asp for Net56 Browser Based File Manager 1.0 allows remote attackers to execute arbitrary SQL commands CVE-2005-16035.0NiteEnterprises Remote File Manager 1.0 allows remote attackers to cause a denial of service (crash) via a crafted string to TCP port 7080.CVE-2005-16047.5PHP Advanced Transfer Manager (phpATM) 1.21 allows remote attackers to upload arbitrary files via filenames containing multiple file extensi CVE-2005-16056.8Cross-site scripting (XSS) vulnerability in the guestbook for SiteStudio 1.6 allows remote attackers to inject arbitrary web script or HTML CVE-2005-16064.6H-Sphere Winbox 2.4.2 and 2.4.3 RC1 stores sensitive information such as username and password in plaintext in world-readable log files, whi CVE-2005-16076.8Cross-site scripting (XSS) vulnerability in shop.cgi in Remote Cart allows remote attackers to inject arbitrary web script or HTML via the (CVE-2005-16085.0Multiple unknown vulnerabilities in the Blocks module in Spidean AutoTheme 1.7 and AT-Lite for PostNuke have unknown impact.