SQL injection vulnerability in WebDB 1.1 and earlier allows remote attackers to execute…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- Partial · Partial · Partial
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-89.
Summary
SQL injection vulnerability in WebDB 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified search parameters, possibly Search0. NOTE: the vendor has disputed this issue, saying that "WebDB is a generic online database system used by many of the clients of Lois Software. The flaw that was identified was some code that was added for a client to do some testing of his system and only certain safe commands were allowed. This code has now been removed and it is not now possible to use SQL queries as part of the query string. No installation or patch is required All clients use a common code library and have their own front end and databases and connections. So as soon as a change / upgrade / enhancement is made to the code, all users of the software begin to use the latest changes immediately." Since the issue appeared in a custom web site and no action is required on the part of customers, this issue should not be included in CVE
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:lois_software:webdb:*:*:*:*:*:*:*:* | up to 1.1 | Vulnerable | Lois Software |
| cpe:2.3:a:lois_software:webdb:1.0:*:*:*:*:*:*:* | 1.0 | Vulnerable | Lois Software |
- cpe:2.3:a:lois_software:webdb:*:*:*:*:*:*:*:* Versions up to 1.1 Vulnerable ·Lois Software
- cpe:2.3:a:lois_software:webdb:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Lois Software
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2005-4515
- 2026-10-03 Alias added: GHSA-mfrc-8wqr-f298
References
Sources
- CVE-2005-4515 · CVE Program
- CVE-2005-4515 · NVD
- FIRST EPSS
- GHSA-mfrc-8wqr-f298 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences