CVE-2005-2902

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

SQL injection vulnerability in class-1 Forum Software 0.24.4 allows remote attackers to execute arbitrary SQL commands and bypass the file extension check via SQL code in the file extension of an uploaded file.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://marc.info/?l=bugtraq&m=112629627512785&w=2
http://secunia.com/advisories/16762/Vendor Advisory
http://www.rgod.altervista.org/class1.htmlExploit, Vendor Advisory
http://www.securityfocus.com/bid/14774Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/22209
http://marc.info/?l=bugtraq&m=112629627512785&w=2
http://secunia.com/advisories/16762/Vendor Advisory
http://www.rgod.altervista.org/class1.htmlExploit, Vendor Advisory
http://www.securityfocus.com/bid/14774Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/22209

Timeline

Published: Sep 14, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2005

CVE-2005-29037.5Heap-based buffer overflow in NOD32 2.5 with nod32.002 1.033 build 1127, with active scanning enabled, allows remote attackers to execute ar CVE-2005-29045.0Zebedee 2.4.1, when "allowed redirection port" is not set, allows remote attackers to cause a denial of service (application crash) via a ze CVE-2005-29125.0Linksys WRT54G router allows remote attackers to cause a denial of service (CPU consumption and server hang) via an HTTP POST request with a CVE-2005-29147.5ezconfig.asp in Linksys WRT54G router 3.01.03, 3.03.6, non-default configurations of 2.04.4, and possibly other versions, does not use an au CVE-2005-29155.0ezconfig.asp in Linksys WRT54G router 3.01.03, 3.03.6, non-default configurations of 2.04.4, and possibly other versions, uses weak encrypti CVE-2005-29165.0Linksys WRT54G 3.01.03, 3.03.6, 4.00.7, and possibly other versions before 4.20.7, does not verify user authentication until after an HTTP P CVE-2005-29175.0Squid 2.5.STABLE10 and earlier, while performing NTLM authentication, does not properly handle certain request sequences, which allows attac CVE-2005-29185.0The open_cmd_tube function in mount.c for gtkdiskfree 1.9.3 and earlier allows local users to overwrite arbitrary files via a symlink attack CVE-2005-29195.0libclamav/fsg.c in Clam AntiVirus (ClamAV) before 0.87 allows remote attackers to cause a denial of service (infinite loop) via a crafted FS CVE-2005-29207.5Buffer overflow in libclamav/upx.c in Clam AntiVirus (ClamAV) before 0.87 allows remote attackers to execute arbitrary code via a crafted UP CVE-2005-29229.3Heap-based buffer overflow in the embedded player in multiple RealNetworks products and versions including RealPlayer 10.x, RealOne Player, CVE-2005-29234.0The IMAP server in IMail Server 8.20 in Ipswitch Collaboration Suite (ICS) before 2.02 allows remote attackers to cause a denial of service