CVE-2005-4478

Papoo <2.1.2 - SQL Injection

Title source: llm

Description

Multiple SQL injection vulnerabilities in Papoo 2.1.2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) menuid parameter to (a) index.php and (b) guestbook.php, and the (2) forumid and (3) reporeid_print parameters to (c) print.php.

Exploits (3)

exploitdb WRITEUP VERIFIED

by r0t3d3Vil · textwebappsphp

https://www.exploit-db.com/exploits/26959

View Code ZIP pw:eip

exploitdb WRITEUP VERIFIED

by r0t3d3Vil · textwebappsphp

https://www.exploit-db.com/exploits/26960

View Code ZIP pw:eip

exploitdb WRITEUP VERIFIED

by r0t3d3Vil · textwebappsphp

https://www.exploit-db.com/exploits/26961

View Code ZIP pw:eip

References (7)

[Third Party Advisory] http://pridels0.blogspot.com/2005/12/papoo-multiple-sql-vuln.html

[Vendor Advisory] http://secunia.com/advisories/18152

[Third Party Advisory, VDB Entry] http://www.osvdb.org/21869

[Third Party Advisory, VDB Entry] http://www.osvdb.org/displayvuln.php?osvdb_id=21870

[Third Party Advisory, VDB Entry] http://www.osvdb.org/displayvuln.php?osvdb_id=21871

[Exploit] http://www.securityfocus.com/bid/16020

[Vendor Advisory] http://www.vupen.com/english/advisories/2005/3046

Scores

EPSS 0.0071

EPSS Percentile 71.8%

Classification

CWE

CWE-89

Status draft

Affected Products (1)

papoo/papoo < 2.1.2

Timeline

Published Dec 22, 2005

Tracked Since Feb 18, 2026