Lucene search

MitreCVE-2004-1553

HistoryFeb 20, 2005 - 5:00 a.m.

CVE-2004-1553

2005-02-2005:00:00

CWE-89

mitre

web.nvd.nist.gov

sql injection

aspwebalbum

remote attackers

arbitrary sql statements

vulnerability

nvd

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

AI Score

8.1

Confidence

Low

EPSS

0.002

Percentile

59.4%

JSON

SQL injection vulnerability in aspWebAlbum allows remote attackers to execute arbitrary SQL statements via (1) the username field on the login page or (2) the cat parameter to album.asp. NOTE: it was later reported that vector 1 affects aspWebAlbum 3.2, and the vector involves the txtUserName parameter in a processlogin action to album.asp, as reachable from the login action.

Affected configurations

Nvd

Node

fullrevolutionaspwebalbumMatch3.2

VendorProductVersionCPE
fullrevolutionaspwebalbum3.2cpe:2.3:a:fullrevolution:aspwebalbum:3.2:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
fullrevolution	aspwebalbum	3.2	cpe:2.3:a:fullrevolution:aspwebalbum:3.2:::::::*

References

marc.info/?l=bugtraq&m=109604910025090&w=2

osvdb.org/47913

osvdb.org/47914

secunia.com/advisories/31649

www.securityfocus.com/bid/11246

www.securityfocus.com/bid/30996

exchange.xforce.ibmcloud.com/vulnerabilities/17507

exchange.xforce.ibmcloud.com/vulnerabilities/44876

exchange.xforce.ibmcloud.com/vulnerabilities/44877

www.exploit-db.com/exploits/6357

www.exploit-db.com/exploits/6420

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

AI Score

8.1

Confidence

Low

EPSS

0.002

Percentile

59.4%

JSON

Related for CVE-2004-1553