CVE-2005-2468

MediumCVSS 6.4/10Last modified Jun 16, 2026

Description

Multiple SQL injection vulnerabilities in MySQL Eventum 1.5.5 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) isCorrectPassword or (2) userExist function in class.auth.php, getCustomFieldReport function in (4) custom_fields.php, (5) custom_fields_graph.php, or (6) class.report.php, or the insert function in (7) releases.php or (8) class.release.php.

Metrics

CVSS 2.0 6.4/10AV:N/AC:L/Au:N/C:P/I:P/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.mysql.com/eventum-users/2072Patch
http://marc.info/?l=bugtraq&m=112292193807958&w=2
http://secunia.com/advisories/16304Patch, Vendor Advisory
http://securitytracker.com/id?1014603Exploit, Patch
http://www.gulftech.org/?node=research&article_id=00093-07312005Exploit
http://www.osvdb.org/18403Exploit, Patch
http://www.osvdb.org/18404Exploit, Patch
http://www.osvdb.org/18405Exploit, Patch
http://www.osvdb.org/18406Exploit, Patch
http://www.securityfocus.com/bid/14437Exploit
http://www.vupen.com/english/advisories/2005/1287
http://lists.mysql.com/eventum-users/2072Patch
http://marc.info/?l=bugtraq&m=112292193807958&w=2
http://secunia.com/advisories/16304Patch, Vendor Advisory
http://securitytracker.com/id?1014603Exploit, Patch
http://www.gulftech.org/?node=research&article_id=00093-07312005Exploit
http://www.osvdb.org/18403Exploit, Patch
http://www.osvdb.org/18404Exploit, Patch
http://www.osvdb.org/18405Exploit, Patch
http://www.osvdb.org/18406Exploit, Patch
http://www.securityfocus.com/bid/14437Exploit
http://www.vupen.com/english/advisories/2005/1287

Timeline

Published: Dec 31, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2005

CVE-2005-24694.6Stack-based buffer overflow in the NMAP Agent for Novell NetMail 3.52C and possibly earlier versions allows local users to execute arbitrary CVE-2005-24707.5Buffer overflow in a "core application plug-in" for Adobe Reader 5.1 through 7.0.2 and Acrobat 5.0 through 7.0.2 allows attackers to cause a CVE-2005-24717.5pstopnm in netpbm does not properly use the "-dSAFER" option when calling Ghostscript to convert a PostScript file into a (1) PBM, (2) PGM, CVE-2005-24725.0Multiple buffer overflows in BusinessMail 4.60.00 allow remote attackers to cause a denial of service (application crash) via a long string CVE-2005-24737.5Multiple SQL injection vulnerabilities in ChurchInfo allow remote attackers to execute arbitrary SQL commands via the PersonID parameter to CVE-2005-24745.0ChurchInfo allows remote attackers to execute obtain sensitive information via the PersonID parameter to (1) PersonView.php, (2) MemberRoleC CVE-2005-24751.2Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being CVE-2005-24764.3Cross-site scripting (XSS) vulnerability in lost_passowrd.php in Naxtor Shopping Cart 1.0 allows remote attackers to inject arbitrary web sc CVE-2005-24775.0shop_display_products.php in Naxtor Shopping Cart 1.0 allows remote attackers to obtain sensitive information via a cat_id with a "'" (singl CVE-2005-24787.5SQL injection vulnerability in SilverNews 2.0.3 allows remote attackers to execute arbitrary SQL commands via the user field on the login pa CVE-2005-24795.0Quick 'n Easy FTP Server 3.0 allows remote attackers to cause a denial of service (application crash or CPU consumption) via a long USER com CVE-2005-24804.3Cross-site scripting (XSS) vulnerability in ColdFusion Fusebox 4.1.0 allows remote attackers to inject arbitrary web script or HTML via the