Lucene search

[email protected]CVE-2004-2412

HistoryDec 31, 2004 - 5:00 a.m.

CVE-2004-2412

2004-12-3105:00:00

NVD-CWE-Other

[email protected]

web.nvd.nist.gov

cve-2004-2412

sql injection

vp-asp

shopping cart

remote attackers

arbitrary sql commands

9.5 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.002 Low

EPSS

Percentile

55.5%

JSON

Multiple SQL injection vulnerabilities in VP-ASP Shopping Cart 4.0 through 5.0 allow remote attackers to execute arbitrary SQL commands via the catalogid parameter in (1) shopreviewlist.asp and (2) shopreviewadd.asp.

CPENameOperatorVersion
virtual_programming:vp-aspvirtual programming vp-aspeq4.0
virtual_programming:vp-aspvirtual programming vp-aspeq5.0
virtual_programming:vp-aspvirtual programming vp-aspeq4.50

CPE	Name	Operator	Version
virtual_programming:vp-asp	virtual programming vp-asp	eq	4.0
virtual_programming:vp-asp	virtual programming vp-asp	eq	5.0
virtual_programming:vp-asp	virtual programming vp-asp	eq	4.50

References

secunia.com/advisories/11201

www.securityfocus.com/bid/9967

www.vpasp.com/virtprog/info/faq_securityfixes.htm

exchange.xforce.ibmcloud.com/vulnerabilities/15588

9.5 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.002 Low

EPSS

Percentile

55.5%

JSON