Sql injection

2007-12-2020:46:00

PRIOn knowledge base

www.prio-n.com

8.9 High

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

69.0%

JSON

Multiple SQL injection vulnerabilities in Hosting Controller 6.1 Hot fix 3.3 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) email and (2) loginname parameters to Hosting/Addreseller.asp, (3) the sortfield parameter to accounts/accountmanager.asp, (4) the GateWayID parameter to OpenApi/GatewayVariables.asp, and possibly (5) unspecified vectors to IIS/iibind.asp.

CPENameOperatorVersion
hosting_controllereq6.1.0-hotfix3.3

CPE	Name	Operator	Version
	hosting_controller	eq	6.1.0-hotfix3.3

References

securityreason.com/securityalert/3474

securitytracker.com/id?1019222

www.securityfocus.com/archive/1/485028/100/0/threaded

www.securityfocus.com/bid/26862

exchange.xforce.ibmcloud.com/vulnerabilities/39036

www.exploit-db.com/exploits/4730