{"api_version":"1","generated_at":"2026-07-23T05:01:11+00:00","cve":"CVE-2004-1949","urls":{"html":"https://cve.report/CVE-2004-1949","api":"https://cve.report/api/cve/CVE-2004-1949.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2004-1949","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2004-1949"},"summary":{"title":"CVE-2004-1949","description":"SQL injection vulnerability in PostNuke 7.2.6 and earlier allows remote attackers to execute arbitrary SQL via (1) the sif parameter to index.php in the Comments module or (2) timezoneoffset parameter to changeinfo.php in the Your_Account module.","state":"PUBLISHED","assigner":"mitre","published_at":"2004-12-31 05:00:00","updated_at":"2025-04-03 01:03:51"},"problem_types":["NVD-CWE-Other","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://securitytracker.com/id?1009801","name":"http://securitytracker.com/id?1009801","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityTracker.com Archives - PostNuke Input Validation Flaw in 'NS-Your_Account' Module Lets Remote Users Inject SQL Commands","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/10146","name":"http://www.securityfocus.com/bid/10146","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"PostNuke Phoenix Multiple Module SQL Injection Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://secunia.com/advisories/11386","name":"http://secunia.com/advisories/11386","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Secunia - Advisories - PostNuke SQL Injection Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.osvdb.org/5369","name":"http://www.osvdb.org/5369","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://lists.grok.org.uk/pipermail/full-disclosure/2004-April/020154.html","name":"http://lists.grok.org.uk/pipermail/full-disclosure/2004-April/020154.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"[Full-Disclosure] [SCAN Associates Sdn Bhd Security Advisory] Postnuke v 0.726 and below SQL injection","mime":"text/html","httpstatus":"404","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/15875","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/15875","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://news.postnuke.com/Article2580.html","name":"http://news.postnuke.com/Article2580.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"403 Forbidden","mime":"text/html","httpstatus":"403","archivestatus":"403"},{"url":"http://marc.info/?l=bugtraq&m=108256503718978&w=2","name":"http://marc.info/?l=bugtraq&m=108256503718978&w=2","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"'[PNSA 2004-2] PostNuke Security Advisory PNSA 2004-2' - MARC","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.osvdb.org/5368","name":"http://www.osvdb.org/5368","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/15869","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/15869","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2004-1949","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2004-1949","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2004","cve_id":"1949","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"postnuke_software_foundation","cpe5":"postnuke","cpe6":"0.726","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-08T01:07:49.130Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"5369","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://www.osvdb.org/5369"},{"name":"10146","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/10146"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://news.postnuke.com/Article2580.html"},{"name":"postnuke-indexphp-sql-injection(15869)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/15869"},{"name":"20040420 [PNSA 2004-2] PostNuke Security Advisory PNSA 2004-2","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://marc.info/?l=bugtraq&m=108256503718978&w=2"},{"name":"20040414 [SCAN Associates Sdn Bhd Security Advisory] Postnuke v 0.726 and below SQL injection","tags":["mailing-list","x_refsource_FULLDISC","x_transferred"],"url":"http://lists.grok.org.uk/pipermail/full-disclosure/2004-April/020154.html"},{"name":"5368","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://www.osvdb.org/5368"},{"name":"1009801","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://securitytracker.com/id?1009801"},{"name":"postnuke-changeinfo-sql-injection(15875)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/15875"},{"name":"11386","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/11386"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2004-04-14T00:00:00.000Z","descriptions":[{"lang":"en","value":"SQL injection vulnerability in PostNuke 7.2.6 and earlier allows remote attackers to execute arbitrary SQL via (1) the sif parameter to index.php in the Comments module or (2) timezoneoffset parameter to changeinfo.php in the Your_Account module."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-07-10T14:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"5369","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://www.osvdb.org/5369"},{"name":"10146","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/10146"},{"tags":["x_refsource_CONFIRM"],"url":"http://news.postnuke.com/Article2580.html"},{"name":"postnuke-indexphp-sql-injection(15869)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/15869"},{"name":"20040420 [PNSA 2004-2] PostNuke Security Advisory PNSA 2004-2","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://marc.info/?l=bugtraq&m=108256503718978&w=2"},{"name":"20040414 [SCAN Associates Sdn Bhd Security Advisory] Postnuke v 0.726 and below SQL injection","tags":["mailing-list","x_refsource_FULLDISC"],"url":"http://lists.grok.org.uk/pipermail/full-disclosure/2004-April/020154.html"},{"name":"5368","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://www.osvdb.org/5368"},{"name":"1009801","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://securitytracker.com/id?1009801"},{"name":"postnuke-changeinfo-sql-injection(15875)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/15875"},{"name":"11386","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/11386"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2004-1949","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"SQL injection vulnerability in PostNuke 7.2.6 and earlier allows remote attackers to execute arbitrary SQL via (1) the sif parameter to index.php in the Comments module or (2) timezoneoffset parameter to changeinfo.php in the Your_Account module."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"5369","refsource":"OSVDB","url":"http://www.osvdb.org/5369"},{"name":"10146","refsource":"BID","url":"http://www.securityfocus.com/bid/10146"},{"name":"http://news.postnuke.com/Article2580.html","refsource":"CONFIRM","url":"http://news.postnuke.com/Article2580.html"},{"name":"postnuke-indexphp-sql-injection(15869)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/15869"},{"name":"20040420 [PNSA 2004-2] PostNuke Security Advisory PNSA 2004-2","refsource":"BUGTRAQ","url":"http://marc.info/?l=bugtraq&m=108256503718978&w=2"},{"name":"20040414 [SCAN Associates Sdn Bhd Security Advisory] Postnuke v 0.726 and below SQL injection","refsource":"FULLDISC","url":"http://lists.grok.org.uk/pipermail/full-disclosure/2004-April/020154.html"},{"name":"5368","refsource":"OSVDB","url":"http://www.osvdb.org/5368"},{"name":"1009801","refsource":"SECTRACK","url":"http://securitytracker.com/id?1009801"},{"name":"postnuke-changeinfo-sql-injection(15875)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/15875"},{"name":"11386","refsource":"SECUNIA","url":"http://secunia.com/advisories/11386"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2004-1949","datePublished":"2005-05-10T04:00:00.000Z","dateReserved":"2005-05-04T00:00:00.000Z","dateUpdated":"2024-08-08T01:07:49.130Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2004-12-31 05:00:00","lastModifiedDate":"2025-04-03 01:03:51","problem_types":["NVD-CWE-Other","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:postnuke_software_foundation:postnuke:0.726:*:*:*:*:*:*:*","matchCriteriaId":"EED5E57D-A2EA-43C7-A29B-537FDE0656A2"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2004","CveId":"1949","Ordinal":"1","Title":"CVE-2004-1949","CVE":"CVE-2004-1949","Year":"2004"},"notes":[{"CveYear":"2004","CveId":"1949","Ordinal":"1","NoteData":"SQL injection vulnerability in PostNuke 7.2.6 and earlier allows remote attackers to execute arbitrary SQL via (1) the sif parameter to index.php in the Comments module or (2) timezoneoffset parameter to changeinfo.php in the Your_Account module.","Type":"Description","Title":"CVE-2004-1949"},{"CveYear":"2004","CveId":"1949","Ordinal":"2","NoteData":"2005-05-10","Type":"Other","Title":"Published"},{"CveYear":"2004","CveId":"1949","Ordinal":"3","NoteData":"2017-07-10","Type":"Other","Title":"Modified"}]}}}