CVE-2005-0805 EXPLOIT
7.5
HIGH · CVSS 2.0 · EPSS 1.2% (pctl 68)
Patch early
A public exploit exists.
Description
SQL injection vulnerability in index.php in Subdreamer Light, when magic_quotes_gpc is enabled, allows remote attackers to execute arbitrary SQL commands via certain parameters that are used as global variables, as demonstrated using the imageid parameter, which is not properly handled by imagegallery.php.
Scoring
| CVSS | 7.5 (HIGH, v2.0) |
|---|---|
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| EPSS | 1.23% — more likely to be exploited than 68% of all CVEs |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2005-05-02 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| subdreamer | subdreamer light |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Subdreamer 1.0 - SQL Injection | 2005-03-18 |
References
- http://marc.info/?l=bugtraq&m=111116479910230&w=2
- http://www.securityfocus.com/archive/1/437983/100/200/threaded
- http://www.securityfocus.com/bid/12839
- http://www.subdreamer.com/forum/showthread.php?t=2501
- http://marc.info/?l=bugtraq&m=111116479910230&w=2
- http://www.securityfocus.com/archive/1/437983/100/200/threaded
- http://www.securityfocus.com/bid/12839
- http://www.subdreamer.com/forum/showthread.php?t=2501
→ the Explorer · watch your stack · NVD