CVE-2005-3521

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

SQL injection vulnerability in resetcore.php in e107 0.617 through 0.6173 allows remote attackers to execute arbitrary SQL commands, bypass authentication, and inject HTML or script via the (1) a_name parameter or (2) user field of the login page.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://e107.org/news.phpPatch
http://marc.info/?l=bugtraq&m=112967223222966&w=2
http://secunia.com/advisories/17237/Patch, Vendor Advisory
http://securitytracker.com/id?1015069Exploit, Vendor Advisory
http://www.osvdb.org/20070
http://www.securityfocus.com/bid/15125Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/22780
http://e107.org/news.phpPatch
http://marc.info/?l=bugtraq&m=112967223222966&w=2
http://secunia.com/advisories/17237/Patch, Vendor Advisory
http://securitytracker.com/id?1015069Exploit, Vendor Advisory
http://www.osvdb.org/20070
http://www.securityfocus.com/bid/15125Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/22780

Timeline

Published: Nov 6, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2005

CVE-2005-35224.3Cross-site scripting (XSS) vulnerability in index.jsp in ManageEngine Netflow Analyzer 4.0.2 allows remote attackers to inject arbitrary web CVE-2005-35237.5Format string vulnerability in friendsd2 in GpsDrive allows remote attackers to execute arbitrary code via the dir (direction) field.CVE-2005-352410.0Buffer overflow in the SSL-ready version of linux-ftpd (linux-ftpd-ssl) 0.17 allows remote attackers to execute arbitrary code by creating a CVE-2005-35259.3Stack-based buffer overflow in an ActiveX control for the installer for Adobe Macromedia Shockwave Player 10.1.0.11 and earlier allows remot CVE-2005-35266.5Buffer overflow in the IMAP daemon in Ipswitch Collaboration Suite 2006.02 and earlier allows remote authenticated users to execute arbitrar CVE-2005-35274.0Race condition in do_coredump in signal.c in Linux kernel 2.6 allows local users to cause a denial of service by triggering a core dump in o CVE-2005-35284.3Cross-site scripting (XSS) vulnerability in tiki-view_forum_thread.php in TikiWiki 1.9.0 through 1.9.2 allows remote attackers to inject arb CVE-2005-35295.0tiki-view_forum_thread.php in TikiWiki 1.9.0 through 1.9.2 allows remote attackers to obtain the installation path via an invalid topics_sor CVE-2005-35304.3Cross-site scripting (XSS) vulnerability in Antville 1.1 allows remote attackers to inject arbitrary web script or HTML via the notfound.ski CVE-2005-35312.1fusermount in FUSE before 2.4.1, if installed setuid root, allows local users to corrupt /etc/mtab and possibly modify mount options by perf CVE-2005-35327.5authpam.c in courier-authdaemon for Courier Mail Server 0.37.3 through 0.52.1, when using pam_tally, does not call the pam_acct_mgmt functio CVE-2005-35337.2Buffer overflow in OSH before 1.7-15 allows local users to execute arbitrary code via a long current working directory and filename.