Multiple SQL injection vulnerabilities in Miraserver 1.0 RC4 and earlier allow remote attackers to execute arbitrary SQL commands via the (…

published 2005-12-20 20 y ago modified 2026-06-16 4 mo ago also EUVD-2005-4403

cvss: 7.5; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.2%; EPSS 1.2% chance of exploitation in 30 days, percentile 69%
public exploits: 3; Exploit-DB

Multiple SQL injection vulnerabilities in Miraserver 1.0 RC4 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) page parameter to index.php, (2) id parameter to newsitem.php, and (3) cat parameter to article.php.

Timeline

2005-12-19 First public exploit (EDB-26902)
2005-12-20 Published

Exploit prediction

1.24% chance of exploitation in the next 30 days, higher than 69% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

EDB-26902 Miraserver 1.0 RC4 - 'article.php?cat' SQL Injection webapps, 2005-12-19
EDB-26901 Miraserver 1.0 RC4 - 'newsitem.php?id' SQL Injection webapps, 2005-12-19
EDB-26900 Miraserver 1.0 RC4 - 'index.php?page' SQL Injection webapps, 2005-12-19

CVSS scores

assigned by	version	score	vector
NVD	2.0	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P

References

osvdb.org /21836
vdb-entry
secunia.com /advisories/18110
third-party-advisory
osvdb.org /21837
vdb-entry
securityfocus.com /bid/15960
vdb-entry
pridels0.blogspot.com /2005/12/miraserver-sql-vuln.html
osvdb.org /21838
vdb-entry

Sources

CVE List CVE-2005-4408
NVD CVE-2005-4408

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary