CVE-2005-4606

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2005-12-31 · updated 2026-06-16
Weakness: CWE-89

Description

SQL injection vulnerability in check_user.asp in multiple Web Wiz products including (1) Site News 3.06 and earlier, (2) Journal 1.0 and earlier, (3) Polls 3.06 and earlier, and (4) and Database Login 1.71 and earlier allows remote attackers to execute arbitrary SQL commands via the txtUserName parameter.

Affected products

Webwiz Database Login: through 1.71
Webwiz Journal: through 1.0
Webwiz Site News: through 3.06; 2.00
Webwiz Weekly Poll: through 3.06

References

http://secunia.com/advisories/18263
http://securityreason.com/securityalert/305
http://www.osvdb.org/22148
http://www.securityfocus.com/archive/1/420551/100/0/threaded
http://www.securityfocus.com/bid/16085
http://www.vupen.com/english/advisories/2006/0007
http://secunia.com/advisories/18263
http://securityreason.com/securityalert/305
http://www.osvdb.org/22148
http://www.securityfocus.com/archive/1/420551/100/0/threaded
http://www.securityfocus.com/bid/16085
http://www.vupen.com/english/advisories/2006/0007

Get alerted when CVE-2005-4606 or the next vulnerability affects your stack