CVE-2005-1134

Serendipity <0.8 - SQL Injection

Title source: llm

Description

SQL injection vulnerability in exit.php for Serendipity 0.8 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) url_id or (2) entry_id parameters.

Exploits (1)

exploitdb WORKING POC VERIFIED

by kre0n · perlwebappsphp

https://www.exploit-db.com/exploits/939

View Code ZIP pw:eip

References (8)

[Patch, Vendor Advisory] http://www.s9y.org/5.html

[Vendor Advisory] http://www.osvdb.org/15542

[Mailing List] http://seclists.org/lists/bugtraq/2005/Apr/0195.html

[Patch, Vendor Advisory] http://secunia.com/advisories/15145

[Patch, Vendor Advisory] http://www.s9y.org/63.html#A9

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/20119

[Vendor Advisory] http://securitytracker.com/id?1013699

[Exploit, Patch, Vendor Advisory] http://www.securityfocus.com/bid/13161

Scores

EPSS 0.0343

EPSS Percentile 87.5%

Details

Status published

Products (18)

s9y/serendipity 0.3

s9y/serendipity 0.4

s9y/serendipity 0.5

s9y/serendipity 0.5_pl1

s9y/serendipity 0.6

s9y/serendipity 0.6_pl1

s9y/serendipity 0.6_pl2

s9y/serendipity 0.6_pl3

s9y/serendipity 0.6_rc1

s9y/serendipity 0.6_rc2

... and 8 more

Published Apr 13, 2005

Tracked Since Feb 18, 2026