CVE-2005-2989

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Multiple SQL injection vulnerabilities in DeluxeBB 1.0 and 1.0.5 allow remote attackers to execute arbitrary SQL commands via the (1) tid parameter to topic.php, the uid parameter to (2) misc.php or (3) pm.php, or the fid parameter to (3) forums.php or (4) newpost.php.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/16819Exploit, Patch, Vendor Advisory
http://www.securityfocus.com/bid/14851Exploit
http://www.vupen.com/english/advisories/2005/1752
http://secunia.com/advisories/16819Exploit, Patch, Vendor Advisory
http://www.securityfocus.com/bid/14851Exploit
http://www.vupen.com/english/advisories/2005/1752

Timeline

Published: Sep 20, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2005

CVE-2005-29902.1AuthInfo.java in LineContol Java Client (jlc) before 0.8.1 stores sensitive information such as user passwords in log files.CVE-2005-29912.1ncompress 4.2.4 and earlier allows local users to overwrite arbitrary files via a symlink attack on temporary files using (1) zdiff or (2) z CVE-2005-29922.1arc 5.21j and earlier allows local users to overwrite arbitrary files via a symlink attack on temporary files, a different type of vulnerabi CVE-2005-29931.7Unspecified vulnerability in the FTP Daemon (ftpd) for HP Tru64 UNIX 4.0F PK8 and other versions up to HP Tru64 UNIX 5.1B-3, and HP-UX B.11.CVE-2005-29946.8Unspecified vulnerability in the web client for IBM Rational ClearQuest 2002.05.00 and 2002.05.20, and 2003.06.00 through 2003.06.15 before CVE-2005-29953.6bacula 1.36.3 and earlier allows local users to modify or read sensitive files via symlink attacks on (1) the temporary file used by autocon CVE-2005-29967.5Multiple heap-based and stack-based buffer overflows in certain DCOM server components in VERITAS Storage Exec Storage Exec 5.3 before Hotfi CVE-2005-29975.0Multiple directory traversal vulnerabilities in PHP Advanced Transfer Manager 1.30 allow remote attackers to read arbitrary files via ".." s CVE-2005-29987.5PHP Advanced Transfer Manager 1.30 has a default password for the administrator user, which allows remote attackers to upload and execute ar CVE-2005-29995.0PHP Advanced Transfer Manager 1.30 allows remote attackers to obtain sensitive PHP configuration information via a direct request to test.ph CVE-2005-30004.3Multiple cross-site scripting (XSS) vulnerabilities in viewers/txt.php in PHP Advanced Transfer Manager 1.30 allow remote attackers to injec CVE-2005-30012.1Unspecified vulnerability in the "tl" driver in Solaris 10 allows local users to cause a denial of service (panic) via unknown vectors.