CVE-2005-0413

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2005-04-27 · updated 2026-06-16
Weakness: CWE-89

Description

Multiple SQL injection vulnerabilities in MyPHP Forum 1.0 allow remote attackers to execute arbitrary SQL commands via (1) the fid in forum.php, (2) the member parameter in member.php, (3) the email parameter in forgot.php, or (4) the nbuser or nbpass parameters in include.php. NOTE: it was later reported that vector 2 exists in 3.0 and earlier.

Affected products

Myphp Forum: 1.0, 2.0, 3.0

References

http://seclists.org/lists/bugtraq/2005/Feb/0125.html
http://secunia.com/advisories/14205
http://securitytracker.com/id?1013136
http://www.securityfocus.com/bid/12501
http://www.securityfocus.com/bid/27083
https://exchange.xforce.ibmcloud.com/vulnerabilities/19272
https://exchange.xforce.ibmcloud.com/vulnerabilities/39348
https://www.exploit-db.com/exploits/4822
http://seclists.org/lists/bugtraq/2005/Feb/0125.html
http://secunia.com/advisories/14205
http://securitytracker.com/id?1013136
http://www.securityfocus.com/bid/12501

Get alerted when CVE-2005-0413 or the next vulnerability affects your stack