$ cve CVE-2005-4195 JSON

CVE-2005-4195 EXPLOIT

7.5

HIGH · CVSS 2.0 · EPSS 5.5% (pctl 93)

Patch early

A public exploit exists.

Description

Multiple SQL injection vulnerabilities in Scout Portal Toolkit (SPT) 1.3.1 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the ParentId parameter in SPT--BrowseResources.php, (2) ResourceId parameter in SPT--FullRecord.php, (3) ResourceOffset parameter in SPT--Home.php, and (4) F_UserName and (5) F_Password in SPT--UserLogin.php. NOTE: it was later reported that vector 1 is also present in 1.4.0.

Scoring

CVSS	7.5 (HIGH, v2.0)
Vector	AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS	5.5% — more likely to be exploited than 93% of all CVEs
Weakness	CWE-89
On CISA KEV	no
Public exploit	yes
Published	2005-12-13
Last modified	2026-06-16

Affected (2)

Vendor	Product
internet scout	scout portal toolkit
internet scout project	scout portal toolkit

Public exploits

Source	Title	Date
exploit-db	Scout Portal Toolkit 1.4.0 - 'ParentId' SQL Injection	2008-05-04
exploit-db	Scout Portal Toolkit 1.3.1 - 'SPT-UserLogin.php' SQL Injection	2005-12-12

References

→ the Explorer · watch your stack · NVD