CVE-2004-1949
Summary
| CVE | CVE-2004-1949 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2004-12-31 05:00:00 UTC |
| Updated | 2025-04-03 01:03:51 UTC |
| Description | SQL injection vulnerability in PostNuke 7.2.6 and earlier allows remote attackers to execute arbitrary SQL via (1) the sif parameter to index.php in the Comments module or (2) timezoneoffset parameter to changeinfo.php in the Your_Account module. |
Risk And Classification
Primary CVSS: v2.0 7.5 from [email protected]
AV:N/AC:L/Au:N/C:P/I:P/A:P
Problem Types: NVD-CWE-Other | n/a
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
LowAuthentication
NoneConfidentiality
PartialIntegrity
PartialAvailability
PartialAV:N/AC:L/Au:N/C:P/I:P/A:P
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Postnuke Software Foundation | Postnuke | 0.726 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| SecurityTracker.com Archives - PostNuke Input Validation Flaw in 'NS-Your_Account' Module Lets Remote Users Inject SQL Commands | af854a3a-2127-422b-91ae-364da2661108 | securitytracker.com | |
| PostNuke Phoenix Multiple Module SQL Injection Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | Patch |
| Secunia - Advisories - PostNuke SQL Injection Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| www.osvdb.org/5369 | af854a3a-2127-422b-91ae-364da2661108 | www.osvdb.org | |
| [Full-Disclosure] [SCAN Associates Sdn Bhd Security Advisory] Postnuke v 0.726 and below SQL injection | af854a3a-2127-422b-91ae-364da2661108 | lists.grok.org.uk | Exploit |
| IBM X-Force Exchange | af854a3a-2127-422b-91ae-364da2661108 | exchange.xforce.ibmcloud.com | |
| 403 Forbidden | af854a3a-2127-422b-91ae-364da2661108 | news.postnuke.com | Vendor Advisory |
| '[PNSA 2004-2] PostNuke Security Advisory PNSA 2004-2' - MARC | af854a3a-2127-422b-91ae-364da2661108 | marc.info | |
| www.osvdb.org/5368 | af854a3a-2127-422b-91ae-364da2661108 | www.osvdb.org | |
| IBM X-Force Exchange | af854a3a-2127-422b-91ae-364da2661108 | exchange.xforce.ibmcloud.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.