CVE-2005-3019

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2005-09-21 · updated 2026-06-16

Description

Multiple SQL injection vulnerabilities in vBulletin before 3.0.9 allow remote attackers to execute arbitrary SQL commands via the (1) request parameter to joinrequests.php, (2) limitnumber or (3) limitstart to user.php, (4) usertitle.php, or (5) usertools.php.

Affected products

Jelsoft Vbulletin: 1.0.1, 2.0.3, 2.0_rc2, 2.0_rc3, 2.2.0, 2.2.1 (+28)

References

http://marc.info/?l=bugtraq&m=112715150320677&w=2
http://morph3us.org/advisories/20050917-vbulletin-3.0.8.txt
http://secunia.com/advisories/16873/
http://www.securityfocus.com/bid/14872
https://exchange.xforce.ibmcloud.com/vulnerabilities/22323
http://marc.info/?l=bugtraq&m=112715150320677&w=2
http://morph3us.org/advisories/20050917-vbulletin-3.0.8.txt
http://secunia.com/advisories/16873/
http://www.securityfocus.com/bid/14872
https://exchange.xforce.ibmcloud.com/vulnerabilities/22323

Get alerted when CVE-2005-3019 or the next vulnerability affects your stack