CVE-2005-3365

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2005-10-30 · updated 2026-06-16
Weakness: CWE-89

Description

Multiple SQL injection vulnerabilities in DCP-Portal 6 and earlier allow remote attackers to execute arbitrary SQL commands, possibly requiring encoded characters, via (1) the name parameter in register.php, (2) the email parameter in lostpassword.php, (3) the year parameter in calendar.php, and the (4) cid parameter to index.php. NOTE: the mid parameter for forums.php is already associated with CVE-2005-0454. NOTE: the index.php/cid vector was later reported to affect 6.11.

Affected products

Codeworx Technologies Dcp-Portal: 3.7, 4.0, 4.1, 4.2, 4.5.1, 5.0.1 (+7)

References

http://glide.stanford.edu/yichen/research/sec.pdf
http://marc.info/?l=bugtraq&m=113017151829342&w=2
http://secunia.com/advisories/12751/
http://securityreason.com/securityalert/108
http://www.osvdb.org/20493
http://www.osvdb.org/20494
http://www.securityfocus.com/archive/1/419280/100/0/threaded
http://www.securityfocus.com/bid/15183
http://www.securityfocus.com/bid/27167
https://exchange.xforce.ibmcloud.com/vulnerabilities/22855
https://exchange.xforce.ibmcloud.com/vulnerabilities/39447
https://www.exploit-db.com/exploits/4853

Get alerted when CVE-2005-3365 or the next vulnerability affects your stack