Sign-up

ID

VAR-200512-0471


CVE

CVE-2005-4006


TITLE

SAPID CMS Verification bypass vulnerability

Trust: 0.6

sources: CNNVD: CNNVD-200512-055

DESCRIPTION

SAPID CMS before 1.2.3.03 allows remote attackers to bypass authentication via direct requests to the usr/system files (1) insert_file.php, (2) insert_image.php, (3) insert_link.php, (4) insert_qcfile.php, and (5) edit.php. This issue is due to a failure in the application to perform proper authentication on user credentials before granting access to privileged scripts. An attacker can exploit this vulnerability to access privileged scripts without requiring authentication credentials

Trust: 1.17

sources: NVD: CVE-2005-4006 // BID: 15689

AFFECTED PRODUCTS

vendor:redgraphicmodel:sapid cmsscope:eqversion:1.2.3

Trust: 1.6

vendor:redgraphicmodel:sapid cmsscope:lteversion:1.2.3.02

Trust: 1.0

vendor:redgraphicmodel:sapid cmsscope:eqversion:1.2.3.02

Trust: 0.6

vendor:sapidmodel:cms rc2scope:eqversion:1.2.3

Trust: 0.3

vendor:sapidmodel:cmsscope:eqversion:1.2.3

Trust: 0.3

vendor:sapidmodel:cms rc3scope:neversion:1.2.3

Trust: 0.3

sources: BID: 15689 // CNNVD: CNNVD-200512-055 // NVD: CVE-2005-4006

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2005-4006
value: HIGH

Trust: 1.0

CNNVD: CNNVD-200512-055
value: HIGH

Trust: 0.6

nvd@nist.gov: CVE-2005-4006
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

sources: CNNVD: CNNVD-200512-055 // NVD: CVE-2005-4006

PROBLEMTYPE DATA

problemtype:CWE-287

Trust: 1.0

sources: NVD: CVE-2005-4006

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200512-055

TYPE

authorization issue

Trust: 0.6

sources: CNNVD: CNNVD-200512-055

EXTERNAL IDS

db:BIDid:15689

Trust: 1.9

db:OSVDBid:21389

Trust: 1.6

db:VUPENid:ADV-2005-2703

Trust: 1.6

db:SECUNIAid:17859

Trust: 1.6

db:NVDid:CVE-2005-4006

Trust: 1.6

db:CNNVDid:CNNVD-200512-055

Trust: 0.6

sources: BID: 15689 // CNNVD: CNNVD-200512-055 // NVD: CVE-2005-4006

REFERENCES

url:http://sapid-club.com/en/viewtopic.php?p=586#586

Trust: 1.9

url:http://secunia.com/advisories/17859

Trust: 1.6

url:http://www.osvdb.org/21389

Trust: 1.6

url:http://sourceforge.net/project/shownotes.php?release_id=375289&group_id=118100

Trust: 1.6

url:http://www.securityfocus.com/bid/15689

Trust: 1.6

url:http://www.vupen.com/english/advisories/2005/2703

Trust: 1.0

url:http://www.frsirt.com/english/advisories/2005/2703

Trust: 0.6

url:http://sourceforge.net/project/showfiles.php?group_id=118100

Trust: 0.3

sources: BID: 15689 // CNNVD: CNNVD-200512-055 // NVD: CVE-2005-4006

CREDITS

SAPID

Trust: 0.6

sources: CNNVD: CNNVD-200512-055

SOURCES

db:BIDid:15689
db:CNNVDid:CNNVD-200512-055
db:NVDid:CVE-2005-4006

LAST UPDATE DATE

2024-08-14T13:50:55.846000+00:00


SOURCES UPDATE DATE

db:BIDid:15689date:2005-12-02T00:00:00
db:CNNVDid:CNNVD-200512-055date:2005-12-05T00:00:00
db:NVDid:CVE-2005-4006date:2024-02-14T01:17:43.863

SOURCES RELEASE DATE

db:BIDid:15689date:2005-12-02T00:00:00
db:CNNVDid:CNNVD-200512-055date:2005-12-04T00:00:00
db:NVDid:CVE-2005-4006date:2005-12-05T01:03:00