Search...

WorkforceROI Xpede sprc.asp SQL Injection

2002-04-19T00:00:00

ID OSVDB:4240
Type osvdb
Reporter OSVDB
Modified 2002-04-19T00:00:00

Description

No description provided by the source

References:

Related OSVDB ID: 4242 Related OSVDB ID: 4241 Related OSVDB ID: 4238 Related OSVDB ID: 4239 Other Advisory URL: http://archives.neohapsis.com/archives/bugtraq/2002-04/0273.html ISS X-Force ID: 8900 CVE-2002-0579 Bugtraq ID: 4552

JSON Vulners Source

Initial Source

{"type": "osvdb", "published": "2002-04-19T00:00:00", "href": "https://vulners.com/osvdb/OSVDB:4240", "bulletinFamily": "software", "cvss": {"vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/", "score": 7.5}, "viewCount": 22, "edition": 1, "reporter": "OSVDB", "title": "WorkforceROI Xpede sprc.asp SQL Injection", "affectedSoftware": [], "enchantments": {"score": {"value": 6.4, "vector": "NONE", "modified": "2017-04-28T13:19:58", "rev": 2}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2002-0579"]}, {"type": "osvdb", "idList": ["OSVDB:4241", "OSVDB:4242", "OSVDB:4238", "OSVDB:4239"]}], "modified": "2017-04-28T13:19:58", "rev": 2}, "vulnersScore": 6.4}, "references": [], "id": "OSVDB:4240", "lastseen": "2017-04-28T13:19:58", "cvelist": ["CVE-2002-0579"], "modified": "2002-04-19T00:00:00", "description": "# No description provided by the source\n\n## References:\n[Related OSVDB ID: 4242](https://vulners.com/osvdb/OSVDB:4242)\n[Related OSVDB ID: 4241](https://vulners.com/osvdb/OSVDB:4241)\n[Related OSVDB ID: 4238](https://vulners.com/osvdb/OSVDB:4238)\n[Related OSVDB ID: 4239](https://vulners.com/osvdb/OSVDB:4239)\nOther Advisory URL: http://archives.neohapsis.com/archives/bugtraq/2002-04/0273.html\nISS X-Force ID: 8900\n[CVE-2002-0579](https://vulners.com/cve/CVE-2002-0579)\nBugtraq ID: 4552\n"}

{"cve": [{"lastseen": "2021-02-02T05:19:06", "description": "WorkforceROI Xpede 4.1 allows remote attackers to gain privileges as an Xpede administrator via a direct HTTP request to the /admin/adminproc.asp script, which does not prompt for a password.", "edition": 4, "cvss3": {}, "published": "2002-06-18T04:00:00", "title": "CVE-2002-0579", "type": "cve", "cwe": ["NVD-CWE-Other"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": true, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2002-0579"], "modified": "2008-09-05T20:28:00", "cpe": ["cpe:/a:workforceroi:xpede:4.1"], "id": "CVE-2002-0579", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2002-0579", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:workforceroi:xpede:4.1:*:*:*:*:*:*:*"]}], "osvdb": [{"lastseen": "2017-04-28T13:19:58", "bulletinFamily": "software", "cvelist": ["CVE-2002-0579"], "edition": 1, "description": "# No description provided by the source\n\n## References:\n[Related OSVDB ID: 4242](https://vulners.com/osvdb/OSVDB:4242)\n[Related OSVDB ID: 4240](https://vulners.com/osvdb/OSVDB:4240)\n[Related OSVDB ID: 4238](https://vulners.com/osvdb/OSVDB:4238)\n[Related OSVDB ID: 4239](https://vulners.com/osvdb/OSVDB:4239)\nOther Advisory URL: http://archives.neohapsis.com/archives/bugtraq/2002-04/0273.html\nISS X-Force ID: 8900\n[CVE-2002-0579](https://vulners.com/cve/CVE-2002-0579)\nBugtraq ID: 4552\n", "modified": "2002-04-19T00:00:00", "published": "2002-04-19T00:00:00", "href": "https://vulners.com/osvdb/OSVDB:4241", "id": "OSVDB:4241", "type": "osvdb", "title": "WorkforceROI Xpede reports Directory Protection Bypass", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:19:58", "bulletinFamily": "software", "cvelist": ["CVE-2002-0579"], "edition": 1, "description": "# No description provided by the source\n\n## References:\n[Related OSVDB ID: 4242](https://vulners.com/osvdb/OSVDB:4242)\n[Related OSVDB ID: 4241](https://vulners.com/osvdb/OSVDB:4241)\n[Related OSVDB ID: 4240](https://vulners.com/osvdb/OSVDB:4240)\n[Related OSVDB ID: 4238](https://vulners.com/osvdb/OSVDB:4238)\nOther Advisory URL: http://archives.neohapsis.com/archives/bugtraq/2002-04/0273.html\nISS X-Force ID: 8900\n[CVE-2002-0579](https://vulners.com/cve/CVE-2002-0579)\nBugtraq ID: 4552\n", "modified": "2002-04-19T00:00:00", "published": "2002-04-19T00:00:00", "href": "https://vulners.com/osvdb/OSVDB:4239", "id": "OSVDB:4239", "type": "osvdb", "title": "WorkforceROI Xpede datasource.asp SQL Account Disclosure", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:19:58", "bulletinFamily": "software", "cvelist": ["CVE-2002-0579"], "edition": 1, "description": "## Vulnerability Description\nXPede does not prompt non-administrative users for administrative authentication credentials if they attempt to access an administrative script. It is possible that the flaw may allow gain unauthorized access to the administrative facilities resulting in a loss of confidentiality, integrity, and/or availability.\n## Solution Description\nCurrently, there are no known upgrades or patches to correct this issue. It is possible to correct the flaw by implementing the following workaround(s): Use of NTLM1 authentication and placing restrictive permissions on the directory containing the administrative scripts may help to mitigate this issue.\n## Short Description\nXPede does not prompt non-administrative users for administrative authentication credentials if they attempt to access an administrative script. It is possible that the flaw may allow gain unauthorized access to the administrative facilities resulting in a loss of confidentiality, integrity, and/or availability.\n## References:\n[Related OSVDB ID: 4241](https://vulners.com/osvdb/OSVDB:4241)\n[Related OSVDB ID: 4240](https://vulners.com/osvdb/OSVDB:4240)\n[Related OSVDB ID: 4238](https://vulners.com/osvdb/OSVDB:4238)\n[Related OSVDB ID: 4239](https://vulners.com/osvdb/OSVDB:4239)\nOther Advisory URL: http://archives.neohapsis.com/archives/bugtraq/2002-04/0273.html\nKeyword: authentication\nKeyword: XPede\nISS X-Force ID: 8900\n[CVE-2002-0579](https://vulners.com/cve/CVE-2002-0579)\nBugtraq ID: 4552\n", "modified": "2002-04-19T00:00:00", "published": "2002-04-19T00:00:00", "href": "https://vulners.com/osvdb/OSVDB:4242", "id": "OSVDB:4242", "type": "osvdb", "title": "WorkforceROI Xpede Arbitrary Timesheet Display", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:19:58", "bulletinFamily": "software", "cvelist": ["CVE-2002-0579"], "edition": 1, "description": "# No description provided by the source\n\n## References:\n[Related OSVDB ID: 4242](https://vulners.com/osvdb/OSVDB:4242)\n[Related OSVDB ID: 4241](https://vulners.com/osvdb/OSVDB:4241)\n[Related OSVDB ID: 4240](https://vulners.com/osvdb/OSVDB:4240)\n[Related OSVDB ID: 4239](https://vulners.com/osvdb/OSVDB:4239)\nOther Advisory URL: http://archives.neohapsis.com/archives/bugtraq/2002-04/0273.html\nISS X-Force ID: 8900\n[CVE-2002-0579](https://vulners.com/cve/CVE-2002-0579)\nBugtraq ID: 4552\n", "modified": "2002-04-19T00:00:00", "published": "2002-04-19T00:00:00", "href": "https://vulners.com/osvdb/OSVDB:4238", "id": "OSVDB:4238", "type": "osvdb", "title": "WorkforceROI Xpede adminproc.asp Authentication Bypass", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}]}