« Volver al listado

CVE-2005-4469

Estado: ModificadaAlta (7.5)—

Múltiples vulnerabilidades de inyección directa de código estático en PHPGedView 3.3.7 y anteriores permiten a atacantes remotos ejecutar código PHP arbitrario mediante (1) el campo username en login.php, o los parámetros (2) user_language, (3) user_email y (4) user_gedcomid en login_register.php, que se inserta directamente en authenticate.php.

Traducción automática del texto original de NVD (en inglés).

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Phpgedview — Phpgedview

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2005-4469",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": true,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2005-12-22T00:03:00.000",
  "references": [
    {
      "url": "http://cvs.sourceforge.net/viewcvs.py/phpgedview/phpGedView/login_register.php?r1=1.71.2.35&r2=1.71.2.36",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://cvs.sourceforge.net/viewcvs.py/phpgedview/phpGedView/login_register.php?r1=1.71.2.36&r2=1.71.2.37",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://rgod.altervista.org/phpgedview_337_xpl.html",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/18177",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://securitytracker.com/id?1015395",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.osvdb.org/22010",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/419906/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/15983",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2005/3033",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/23873",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://sourceforge.net/tracker/index.php?func=detail&aid=1386434&group_id=55456&atid=477081",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://cvs.sourceforge.net/viewcvs.py/phpgedview/phpGedView/login_register.php?r1=1.71.2.35&r2=1.71.2.36",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://cvs.sourceforge.net/viewcvs.py/phpgedview/phpGedView/login_register.php?r1=1.71.2.36&r2=1.71.2.37",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://rgod.altervista.org/phpgedview_337_xpl.html",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/18177",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://securitytracker.com/id?1015395",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.osvdb.org/22010",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/419906/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/15983",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2005/3033",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/23873",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://sourceforge.net/tracker/index.php?func=detail&aid=1386434&group_id=55456&atid=477081",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple direct static code injection vulnerabilities in PHPGedView 3.3.7 and earlier allow remote attackers to execute arbitrary PHP code via (1) the username field in login.php, or the (2) user_language, (3) user_email, and (4) user_gedcomid parameters in login_register.php, which is directly inserted into authenticate.php."
    }
  ],
  "lastModified": "2026-06-16T22:18:51.393",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:phpgedview:phpgedview:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AED43D4D-7487-499F-B870-E1E76E505E0D",
              "versionEndIncluding": "3.3.7"
            },
            {
              "criteria": "cpe:2.3:a:phpgedview:phpgedview:2.52.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "56A9CE2D-8079-4E71-A049-493A7A72C9A0"
            },
            {
              "criteria": "cpe:2.3:a:phpgedview:phpgedview:2.60:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EDA13EED-7C5F-4F5E-AEC2-D5DA0206B238"
            },
            {
              "criteria": "cpe:2.3:a:phpgedview:phpgedview:2.61:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CE53F2DA-37A7-482C-81BE-8D2D12489462"
            },
            {
              "criteria": "cpe:2.3:a:phpgedview:phpgedview:2.61.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "65B164FD-C465-4C3D-B929-3A5B18D8897B"
            },
            {
              "criteria": "cpe:2.3:a:phpgedview:phpgedview:2.65:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "12A0E38B-C9E3-4619-B1A1-94C11546D6DB"
            },
            {
              "criteria": "cpe:2.3:a:phpgedview:phpgedview:2.65.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2F4C6AC9-0DBB-42AE-BDAE-48CDA55913E4"
            },
            {
              "criteria": "cpe:2.3:a:phpgedview:phpgedview:2.65.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4E75ABEB-BAF8-471B-B360-2E82C0B0EDE8"
            },
            {
              "criteria": "cpe:2.3:a:phpgedview:phpgedview:2.65_beta5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8875F438-0D55-4530-A8B1-0499DE9A43AB"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}