CVE-2005-2468

Severity: medium (CVSS 6.4 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2005-12-31 · updated 2026-06-16

Description

Multiple SQL injection vulnerabilities in MySQL Eventum 1.5.5 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) isCorrectPassword or (2) userExist function in class.auth.php, getCustomFieldReport function in (4) custom_fields.php, (5) custom_fields_graph.php, or (6) class.report.php, or the insert function in (7) releases.php or (8) class.release.php.

Affected products

Mysql Eventum: 1.1, 1.2, 1.2.2, 1.3, 1.3.1, 1.4 (+2)

References

http://lists.mysql.com/eventum-users/2072
http://marc.info/?l=bugtraq&m=112292193807958&w=2
http://secunia.com/advisories/16304
http://securitytracker.com/id?1014603
http://www.gulftech.org/?node=research&article_id=00093-07312005
http://www.osvdb.org/18403
http://www.osvdb.org/18404
http://www.osvdb.org/18405
http://www.osvdb.org/18406
http://www.securityfocus.com/bid/14437
http://www.vupen.com/english/advisories/2005/1287
http://lists.mysql.com/eventum-users/2072

Get alerted when CVE-2005-2468 or the next vulnerability affects your stack