CVE-2005-1948

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Multiple SQL injection vulnerabilities in Invision Gallery before 1.3.1 allow remote attackers to execute arbitrary SQL commands via (1) the comment parameter in an editcomment action or (2) the rating parameter when voting on a photo.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://marc.info/?l=bugtraq&m=111834146710329&w=2
http://www.gulftech.org/?node=research&article_id=00079-06092005Exploit, Patch, Vendor Advisory
http://www.securityfocus.com/bid/13907
http://marc.info/?l=bugtraq&m=111834146710329&w=2
http://www.gulftech.org/?node=research&article_id=00079-06092005Exploit, Patch, Vendor Advisory
http://www.securityfocus.com/bid/13907

Timeline

Published: Jun 9, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2005

CVE-2005-19497.5The eping_validaddr function in functions.php for the ePing plugin for e107 portal allows remote attackers to execute arbitrary commands via CVE-2005-19507.5hints.pl in Webhints 1.03 allows remote attackers to execute arbitrary commands via shell metacharacters in the argument.CVE-2005-19515.0Multiple HTTP Response Splitting vulnerabilities in osCommerce 2.2 Milestone 2 and earlier allow remote attackers to spoof web content and p CVE-2005-19527.5Directory traversal vulnerability in Pico Server (pServ) 3.3 allows remote attackers to read arbitrary files and execute arbitrary commands CVE-2005-19537.5Heap-based buffer overflow in the CGI extension for Pico Server (pServ) 3.3 allows remote attackers to execute arbitrary code via a long HTT CVE-2005-19545.0singapore 0.9.11 allows remote attackers to obtain sensitive information via a direct request to (1) admin.class.php, (2) any .tpl.php file CVE-2005-19554.3Cross-site scripting (XSS) vulnerability in index.php in singapore 0.9.11 allows remote attackers to inject arbitrary web script or HTML via CVE-2005-19565.0File Upload Manager allows remote attackers to upload arbitrary files by modifying the test variable to contain a value of '~~~~~~' (six til CVE-2005-19577.5mtnpeak.net File Upload Manager does not properly check user authentication for certain actions, which allows remote attackers to provide a CVE-2005-19597.5jammail.pl in jamchen JamMail 1.8 allows remote attackers to execute arbitrary commands via shell metacharacters in the mail parameter.CVE-2005-19607.5The getemails function in C.J. Steele Tattle allows remote attackers to execute arbitrary commands via shell metacharacters in certain log e CVE-2005-19614.6Unknown vulnerability in ObjectWeb Consortium C-JDBC before 1.3.1 allows local users to bypass intended access restrictions and obtain the c