Skip to content
Fencer Vulns
high 7.5

CVE-2004-1966 json

Multiple SQL injection vulnerabilities in Open Bulletin Board (OpenBB) 1.0.6 and earlier allow remote attackers to execute arbitrary SQL co…

published 2004-12-31 21 y ago modified 2026-06-16 4 mo ago also EUVD-2004-1958

cvss
7.5
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.3%
EPSS 1.3% chance of exploitation in 30 days, percentile 71%
public exploits
4
Exploit-DB

Summary

Multiple SQL injection vulnerabilities in Open Bulletin Board (OpenBB) 1.0.6 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) FID parameter in board.php, (2) sortorder, perpage, or id parameters in member.php, (3) forums parameter in search.php, or (4) PID or FID parameters in post.php.

Timeline

  1. First public exploit (EDB-24059)
  2. Published

Exploit prediction

1.34% chance of exploitation in the next 30 days, higher than 71% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-24059 OpenBB 1.0.x - 'post.php' Multiple SQL Injections webapps, 2004-04-26
  • EDB-24058 OpenBB 1.0.x - 'search.php?q' SQL Injection webapps, 2004-04-26
  • EDB-24057 OpenBB 1.0.x - 'member.php' Multiple SQL Injections webapps, 2004-04-26
  • EDB-24056 OpenBB 1.0.x - 'board.php?FID' SQL Injection webapps, 2004-04-26
  • securityfocus.com http://www.securityfocus.com/bid/10214 referenced PoC, tagged "exploit" by a source, unverified
  • secunia.com http://secunia.com/advisories/11481 referenced PoC, tagged "exploit" by a source, unverified
  • securitytracker.com http://securitytracker.com/id?1009935 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.