CVE-2004-2695

vBulletin 3.0-3.0.3 - SQL Injection via Authorize.net Callback x_invoice_num Parameter

Title source: llm
STIX 2.1

Description

SQL injection vulnerability in the Authorize.net callback code (subscriptions/authorize.php) in Jelsoft vBulletin 3.0 through 3.0.3 allows remote attackers to execute arbitrary SQL statements via the x_invoice_num parameter. NOTE: this issue might be related to CVE-2006-4267.

References (6)

Core 6
Core References
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/12531/
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/11193
Various Sources x_refsource_confirm
http://www.vbulletin.com/forum/showthread.php?t=124876
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/17365
Various Sources x_refsource_misc
http://www.securiteam.com/unixfocus/5BP0E15E0M.html

Scores

EPSS 0.0191
EPSS Percentile 77.8%

Details

CWE
CWE-89
Status published
Products (12)
jelsoft/vbulletin 3.0
jelsoft/vbulletin 3.0.1
jelsoft/vbulletin 3.0.2
jelsoft/vbulletin 3.0.3
jelsoft/vbulletin 3.0_beta_2
jelsoft/vbulletin 3.0_beta_3
jelsoft/vbulletin 3.0_beta_4
jelsoft/vbulletin 3.0_beta_5
jelsoft/vbulletin 3.0_beta_6
jelsoft/vbulletin 3.0_beta_7
... and 2 more
Published Dec 31, 2004
Tracked Since Feb 18, 2026