CVE-2005-4224

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2005-12-14 · updated 2026-06-16

Description

Multiple "potential" SQL injection vulnerabilities in e107 0.7 might allow remote attackers to execute arbitrary SQL commands via (1) the email, hideemail, image, realname, signature, timezone, and xupexist parameters in signup.php, (2) the content_comment, content_rating, and content_summary parameters in subcontent.php, (3) the download_category and file_demo in upload.php, and (4) the email, hideemail, user_timezone, and user_xup parameters in usersettings.php.

Affected products

e107 CMS: 0.7

References

http://glide.stanford.edu/yichen/research/sec.pdf
http://secunia.com/advisories/18023/
http://www.osvdb.org/21657
http://www.osvdb.org/21658
http://www.osvdb.org/21659
http://www.osvdb.org/21660
http://www.securityfocus.com/archive/1/419280/100/0/threaded
http://www.securityfocus.com/archive/1/419487/100/0/threaded
http://www.vupen.com/english/advisories/2005/2861
http://glide.stanford.edu/yichen/research/sec.pdf
http://secunia.com/advisories/18023/
http://www.osvdb.org/21657

Get alerted when CVE-2005-4224 or the next vulnerability affects your stack