Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.4

paFAQ lets attackers run database commands

CVE-2005-0475 · published 21 years ago
Summary

The paFAQ software can be tricked into running unwanted database queries when certain web page parameters are used. This could let a remote user view, change, or delete your data. Apply the latest update from the vendor or restrict access to the vulnerable pages until it is patched.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
php_arena pafaq beta4
cpe:2.3:a:php_arena:pafaq:beta4:*:*:*:*:*:*:*
Original advisory text
SQL injection vulnerability in paFAQ Beta4, and possibly other versions, allows remote attackers to execute arbitrary SQL code via the (1) offset, (2) limit, (3) order, or (4) orderby parameter to ...
SQL injection vulnerability in paFAQ Beta4, and possibly other versions, allows remote attackers to execute arbitrary SQL code via the (1) offset, (2) limit, (3) order, or (4) orderby parameter to question.php, (5) offset parameter to answer.php, (6) search_item parameter to search.php, (7) cat_id, (8) cid, or (9) id parameter to comment.php.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
6.4 Medium
Exploitation
1% chance of attack within 30 days
Timeline
Published30 Mar 2005
Updated31 Oct 2026
First seen29 Sep 2026
Sources
CVE-2005-0475 · NVD
Track software like this
Free during beta