CVE-2005-4140

Website Baker - SQL Injection

Title source: rule

Description

SQL injection vulnerability in admin/login/index.php in Website Baker 2.6.0 allows remote attackers to execute arbitrary SQL commands via the username parameter, as used by the user field.

Exploits (1)

exploitdb WORKING POC VERIFIED

by rgod · phpwebappsphp

https://www.exploit-db.com/exploits/1363

View Code ZIP pw:eip

References (9)

[Third Party Advisory] http://www.vupen.com/english/advisories/2005/2818

[Third Party Advisory] http://secunia.com/advisories/17945

[Exploit] http://www.securityfocus.com/bid/15776

[Third Party Advisory] http://securityreason.com/securityalert/244

[Third Party Advisory, VDB Entry] http://securitytracker.com/id?1015335

[Third Party Advisory, VDB Entry] http://www.osvdb.org/21572

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/419267/100/0/threaded

[Third Party Advisory] http://archives.neohapsis.com/archives/bugtraq/2005-12/0085.html

[Various Sources] http://rgod.altervista.org/wbaker_260_xpl.html

Scores

EPSS 0.0239

EPSS Percentile 85.1%

Details

Status published

Products (2)

website_baker/website_baker 2.5.2

website_baker/website_baker 2.6

Published Dec 09, 2005

Tracked Since Feb 18, 2026