{"api_version":"1","generated_at":"2026-07-23T07:34:54+00:00","cve":"CVE-2004-2567","urls":{"html":"https://cve.report/CVE-2004-2567","api":"https://cve.report/api/cve/CVE-2004-2567.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2004-2567","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2004-2567"},"summary":{"title":"CVE-2004-2567","description":"Multiple SQL injection vulnerabilities in ReciPants 1.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) user id, (2) recipe id, (3) category id, and (4) other ID number fields.","state":"PUBLISHED","assigner":"mitre","published_at":"2004-12-31 05:00:00","updated_at":"2025-04-03 01:03:51"},"problem_types":["NVD-CWE-Other","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://www.securityfocus.com/bid/10250","name":"http://www.securityfocus.com/bid/10250","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"ReciPants SQL Injection and Cross-Site Scripting Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://securitytracker.com/id?1009984","name":"http://securitytracker.com/id?1009984","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"SecurityTracker.com Archives - ReciPants Input Validation Holes Let Remote Users Inject SQL Commands","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://sourceforge.net/project/shownotes.php?group_id=90737&release_id=234415","name":"http://sourceforge.net/project/shownotes.php?group_id=90737&release_id=234415","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"ReciPants Recipe Manager download | SourceForge.net","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/16024","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/16024","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/11533","name":"http://secunia.com/advisories/11533","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"Secunia - Advisories - ReciPants Unspecified Input Validation Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2004-2567","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2004-2567","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2004","cve_id":"2567","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"recipants","cpe5":"recipants","cpe6":"1.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2004","cve_id":"2567","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"recipants","cpe5":"recipants","cpe6":"1.0.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2004","cve_id":"2567","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"recipants","cpe5":"recipants","cpe6":"1.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2004","cve_id":"2567","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"recipants","cpe5":"recipants","cpe6":"1.1.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-08T01:29:14.057Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_MISC","x_transferred"],"url":"http://sourceforge.net/project/shownotes.php?group_id=90737&release_id=234415"},{"name":"1009984","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://securitytracker.com/id?1009984"},{"name":"recipants-id-sql-injection(16024)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/16024"},{"name":"11533","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/11533"},{"name":"10250","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/10250"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2004-04-27T00:00:00.000Z","descriptions":[{"lang":"en","value":"Multiple SQL injection vulnerabilities in ReciPants 1.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) user id, (2) recipe id, (3) category id, and (4) other ID number fields."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-07-10T14:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"tags":["x_refsource_MISC"],"url":"http://sourceforge.net/project/shownotes.php?group_id=90737&release_id=234415"},{"name":"1009984","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://securitytracker.com/id?1009984"},{"name":"recipants-id-sql-injection(16024)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/16024"},{"name":"11533","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/11533"},{"name":"10250","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/10250"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2004-2567","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple SQL injection vulnerabilities in ReciPants 1.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) user id, (2) recipe id, (3) category id, and (4) other ID number fields."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"http://sourceforge.net/project/shownotes.php?group_id=90737&release_id=234415","refsource":"MISC","url":"http://sourceforge.net/project/shownotes.php?group_id=90737&release_id=234415"},{"name":"1009984","refsource":"SECTRACK","url":"http://securitytracker.com/id?1009984"},{"name":"recipants-id-sql-injection(16024)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/16024"},{"name":"11533","refsource":"SECUNIA","url":"http://secunia.com/advisories/11533"},{"name":"10250","refsource":"BID","url":"http://www.securityfocus.com/bid/10250"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2004-2567","datePublished":"2005-11-22T02:00:00.000Z","dateReserved":"2005-11-22T00:00:00.000Z","dateUpdated":"2024-08-08T01:29:14.057Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2004-12-31 05:00:00","lastModifiedDate":"2025-04-03 01:03:51","problem_types":["NVD-CWE-Other","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":true,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:recipants:recipants:1.0:*:*:*:*:*:*:*","matchCriteriaId":"28164B51-B4D7-442D-BE08-CC426F1A5B50"},{"vulnerable":true,"criteria":"cpe:2.3:a:recipants:recipants:1.0.1:*:*:*:*:*:*:*","matchCriteriaId":"05E27DDC-FD5E-4959-B4B8-CFB6A3537930"},{"vulnerable":true,"criteria":"cpe:2.3:a:recipants:recipants:1.1:*:*:*:*:*:*:*","matchCriteriaId":"A494482E-2F65-473E-BABD-4C8F6EF52790"},{"vulnerable":true,"criteria":"cpe:2.3:a:recipants:recipants:1.1.1:*:*:*:*:*:*:*","matchCriteriaId":"8AE09B14-8C97-402C-9C6C-3813C626516E"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2004","CveId":"2567","Ordinal":"1","Title":"CVE-2004-2567","CVE":"CVE-2004-2567","Year":"2004"},"notes":[{"CveYear":"2004","CveId":"2567","Ordinal":"1","NoteData":"Multiple SQL injection vulnerabilities in ReciPants 1.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) user id, (2) recipe id, (3) category id, and (4) other ID number fields.","Type":"Description","Title":"CVE-2004-2567"},{"CveYear":"2004","CveId":"2567","Ordinal":"2","NoteData":"2005-11-21","Type":"Other","Title":"Published"},{"CveYear":"2004","CveId":"2567","Ordinal":"3","NoteData":"2017-07-10","Type":"Other","Title":"Modified"}]}}}