CVE-2004-2754

N/A Unknown

Published: December 31, 2004 Modified: April 16, 2026

Description

SQL injection vulnerability in SSI.php in YaBB SE 1.5.4, 1.5.3, and possibly other versions before 1.5.5 allows remote attackers to execute arbitrary SQL commands via the ID_MEMBER parameter to the (1) recentTopics and (2) welcome functions.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory

http://securityreason.com/securityalert/3371

Source: cve@mitre.org

http://sourceforge.net/project/shownotes.php?release_id=210608&group_id=57105

Source: cve@mitre.org

Patch

http://www.osvdb.org/3618

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/350244

Source: cve@mitre.org

Exploit

http://www.securityfocus.com/bid/9449

Source: cve@mitre.org

Patch

http://www.securitytracker.com/id?1008764

Source: cve@mitre.org

http://www.yabbse.org/community/index.php?thread=27122

Source: cve@mitre.org

http://securityreason.com/securityalert/3371