Description

SQL injection vulnerability in the loginUser function in the XMLRPC server in XOOPS 2.0.11 and earlier allows remote attackers to execute arbitrary SQL commands and bypass authentication via crafted values in an XML file, as demonstrated using the blogger.getPost method.

Remediation

References

CVE-2005-2113

Related Vulnerabilities

Rukovoditel Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2022-44952)

WordPress Plugin WP User Frontend-Registration, User Profile, Membership, Content Restriction, User Directory, and Frontend Post Submission Supply Chain Attack [Polyfill.io] (4.0.7)

Oracle Database Server Deserialization of Untrusted Data Vulnerability (CVE-2018-14719)

Apache Tomcat Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') Vulnerability (CVE-2023-46589)

MySQL CVE-2022-21312 Vulnerability (CVE-2022-21312)

Severity

High

Classification

CVE-2005-2113

Tags

Missing Update Known Vulnerabilities