CVE-2005-1821

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

PHP remote file inclusion vulnerability in pdl_header.inc.php in PowerDownload 3.0.2 and 3.0.3 allows remote attackers to execute arbitrary PHP code via the incdir parameter to downloads.php.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://marc.info/?l=bugtraq&m=111755754126095&w=2
http://secunia.com/advisories/15537Vendor Advisory
http://securitytracker.com/id?1014078Exploit, Vendor Advisory
http://www.securityfocus.com/bid/13822Exploit, Vendor Advisory
http://www.soulblack.com.ar/repo/papers/advisory/powerdownload_advisory.txtExploit, Vendor Advisory
http://marc.info/?l=bugtraq&m=111755754126095&w=2
http://secunia.com/advisories/15537Vendor Advisory
http://securitytracker.com/id?1014078Exploit, Vendor Advisory
http://www.securityfocus.com/bid/13822Exploit, Vendor Advisory
http://www.soulblack.com.ar/repo/papers/advisory/powerdownload_advisory.txtExploit, Vendor Advisory

Timeline

Published: Jun 1, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2005

CVE-2005-18227.5Multiple SQL injection vulnerabilities in Qualiteam X-Cart 4.0.8 allow remote attackers to execute arbitrary SQL commands via the (1) cat or CVE-2005-18234.3Multiple cross-site scripting (XSS) vulnerabilities in Qualiteam X-Cart 4.0.8 allow remote attackers to inject arbitrary web script or HTML CVE-2005-18247.5The sql_escape_string function in auth/sql.c for the mailutils SQL authentication module does not properly quote the "\" (backslash) charact CVE-2005-18257.5Multiple stack-based buffer overflows in the nvd_exec function in HP Radia Notify Daemon 3.1.2.0 (formerly by Novadigm), and other versions CVE-2005-18267.5Buffer overflow in HP Radia Notify Daemon 3.1.0.0 (formerly by Novadigm), and other versions including 2.x, 3.x, and 4.x, allows remote atta CVE-2005-18277.5D-Link DSL-504T allows remote attackers to bypass authentication and gain privileges, such as upgrade firmware, restart the router or restor CVE-2005-18287.5D-Link DSL-504T stores usernames and passwords in cleartext in the router configuration file, which allows remote attackers to obtain sensit CVE-2005-18295.0Microsoft Internet Explorer 6 SP2 allows remote attackers to cause a denial of service (infinite loop and application crash) via two embedde CVE-2005-18305.0The DbgMsg.sys driver in Compuware SoftICE DriverStudio 3.1 and 3.2 allows remote attackers to cause a denial of service (application crash)CVE-2005-18318.4Sudo 1.6.8p7 on SuSE Linux 9.3, and possibly other Linux distributions, allows local users to gain privileges by using sudo to call su, then CVE-2005-18324.3Multiple cross-site scripting (XSS) vulnerabilities in MyBulletinBoard (MyBB) 1.00 RC4 and earlier allow remote attackers to execute arbitra CVE-2005-18337.5Multiple SQL injection vulnerabilities in MyBulletinBoard (MyBB) 1.00 RC4 allow remote attackers to execute arbitrary SQL commands via the (