Vulnerability Description
Lyris ListManager 5.0 through 8.9a allows remote attackers to add "ORDER BY" columns to SQL queries via unusual whitespace characters in the orderby parameter, such as (1) newlines and (2) 0xFF (ASCII 255) characters, which are interpreted as whitespace.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Lyris | List Manager | 5.0 |
References
- http://archives.neohapsis.com/archives/fulldisclosure/2005-12/0349.html
- http://metasploit.com/research/vulns/lyris_listmanager/Vendor Advisory
- http://secunia.com/advisories/17943PatchVendor Advisory
- http://www.osvdb.org/21549Patch
- http://www.securityfocus.com/archive/1/419077/100/0/threaded
- http://www.securityfocus.com/bid/15787Patch
- http://www.vupen.com/english/advisories/2005/2820
- http://archives.neohapsis.com/archives/fulldisclosure/2005-12/0349.html
- http://metasploit.com/research/vulns/lyris_listmanager/Vendor Advisory
- http://secunia.com/advisories/17943PatchVendor Advisory
- http://www.osvdb.org/21549Patch
- http://www.securityfocus.com/archive/1/419077/100/0/threaded
- http://www.securityfocus.com/bid/15787Patch
- http://www.vupen.com/english/advisories/2005/2820
FAQ
What is CVE-2005-4144?
CVE-2005-4144 is a vulnerability with a CVSS score of 7.5 (HIGH). Lyris ListManager 5.0 through 8.9a allows remote attackers to add "ORDER BY" columns to SQL queries via unusual whitespace characters in the orderby parameter, such as (1) newlines and (2) 0xFF (ASCII...
How severe is CVE-2005-4144?
CVE-2005-4144 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2005-4144?
Check the references section above for vendor advisories and patch information. Affected products include: Lyris List Manager.