CVE-2005-4144
Lyris ListManager 5.0 through 8.9a allows remote attackers to add "ORDER BY" columns to SQL...
Lyris ListManager 5.0 through 8.9a allows remote attackers to add "ORDER BY" columns to SQL queries via unusual whitespace characters in the orderby parameter, such as (1) newlines and (2) 0xFF (ASCII 255) characters, which are interpreted as whitespace.
Exploit likelihood
What each source reports
NVD Score used
Lyris ListManager 5.0 through 8.9a allows remote attackers to add "ORDER BY" columns to SQL queries via unusual whitespace characters in the orderby parameter, such as (1) newlines and (2) 0xFF (ASCII 255) characters, which are interpreted as whitespace.
- Record
CVE-2005-4144- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Lyris ListManager 5.0 through 8.9a allows remote attackers to add "ORDER BY" columns to SQL queries via unusual whitespace characters in the orderby parameter, such as (1) newlines and (2) 0xFF (ASCII 255) characters, which are interpreted as whitespace.
- Record
CVE-2005-4144- Updated
- 2026-11-02
EUVDEUVD-2005-4139 No score
Lyris ListManager 5.0 through 8.9a allows remote attackers to add "ORDER BY" columns to SQL queries via unusual whitespace characters in the orderby parameter, such as (1) newlines and (2) 0xFF (ASCII 255) characters, which are interpreted as whitespace.
- Record
EUVD-2005-4139- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9fpm-9892-q4hp No score
Lyris ListManager 5.0 through 8.9a allows remote attackers to add "ORDER BY" columns to SQL...
Lyris ListManager 5.0 through 8.9a allows remote attackers to add "ORDER BY" columns to SQL queries via unusual whitespace characters in the orderby parameter, such as (1) newlines and (2) 0xFF (ASCII 255) characters, which are interpreted as whitespace.
- Record
GHSA-9fpm-9892-q4hp- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2005-4144 is a high vulnerability (CVSS 7.5) in Lyris List Manager, published December 10, 2005. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.76%, the 78th percentile. No source names a fixed version.
References
securityfocus.com/archive/1/419077/100/0/threaded
metasploit.com/research/vulns/lyris_listmanager
vupen.com/english/advisories/2005/2820
archives.neohapsis.com/archives/fulldisclosure/2005-12/0349.html
osvdb.org/21549
secunia.com/advisories/17943
nvd.nist.gov/vuln/detail/CVE-2005-4144
github.com/advisories/GHSA-9fpm-9892-q4hp