CVE-2005-1413

CVE-2005-1413 describes multiple SQL injection vulnerabilities in enVivo!CMS, specifically affecting the envivosoft envivo_cms product. Attackers can exploit these flaws by manipulating the username or password parameters in admin_login.asp, or the searchstring and potentially the ID parameters in default.asp. This allows for remote execution of arbitrary SQL commands, leading to potential privilege escalation and compromise of confidentiality, integrity, and availability. The vulnerability has a CVSS score of 7.5, indicating high severity, with a network-based attack vector and low access complexity, requiring no authentication. While not listed on the KEV catalog or Hot List, an exploit for the 'default.asp?ID' parameter is publicly available on ExploitDB. Despite this, there is no evidence of active exploitation, Metasploit or Nuclei modules, or significant community discussion or media coverage.