ActiveWeb Contentserver Picture_Real_Edit.ASP SQL注入漏洞

ActiveWeb Contentserver是一款基于ASP的WEB应用程序。 ActiveWeb Contentserver不正确过滤用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，获得敏感信息。 问题是'picturerealedit.asp'脚本对用户提交的'id'参数缺少过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息。 activeWeb contentserver 5.6.2929 升级到5.6.2964版本： http://www.active-web.de/aw/home/Produkte/gf/contentserver/...

CVE-2007-3013

SQL injection vulnerability in activeWeb contentserver before 5.6.2964 allows remote authenticated users with edit permission to execute arbitrary SQL commands via the id parameter to admin/picture/picturerealedit.asp, and probably other unspecified vectors...

Sql injection

SQL injection vulnerability in activeWeb contentserver before 5.6.2964 allows remote authenticated users with edit permission to execute arbitrary SQL commands via the id parameter to admin/picture/picturerealedit.asp, and probably other unspecified vectors...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in activeWeb contentserver before 5.6.2964 allow remote attackers to inject arbitrary web script or HTML via the msg parameter to 1 errors/rights.asp or 2 errors/transaction.asp, or 3 the name of a MIME type mimetype...

CVE-2007-3014

Multiple cross-site scripting XSS vulnerabilities in activeWeb contentserver before 5.6.2964 allow remote attackers to inject arbitrary web script or HTML via the msg parameter to 1 errors/rights.asp or 2 errors/transaction.asp, or 3 the name of a MIME type mimetype...

CVE-2007-3013

SQL injection vulnerability in activeWeb contentserver before 5.6.2964 allows remote authenticated users with edit permission to execute arbitrary SQL commands via the id parameter to admin/picture/picturerealedit.asp, and probably other unspecified vectors...

CVE-2007-3014

CVE-2007-3014 affects activeWeb contentserver prior to 5.6.2964. The vulnerability is multiple cross-site scripting (XSS) flaws exploitable via the msg parameter in errors/rights.asp and errors/transaction.asp, and via the name of a MIME type when adding new mimetypes. Affected versions are

CVE-2007-3013

CVE-2007-3013 affects activeWeb contentserver: SQL injection in the picture_real_edit.asp endpoint (id parameter) that can be exploited by editors with edit permission to execute arbitrary SQL. Affected versions were

contentserver 5.6.2929 - errorstransaction.asp?msg Cross-Site Scripting

contentserver 5.6.2929 - errorstransaction.asp?msg Cross-Site Scripting source: https://www.securityfocus.com/bid/24895/info activeWeb contentserver is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker may...

rt-sa-2007-004.txt

Advisory: ActiveWeb Contentserver CMS SQL Injection Management Interface RedTeam Pentesting discovered an SQL Injection in the picturerealedit.asp script of the activeWeb contentserver CMS during a penetration test. An editor with the permission to edit pictures can exploit this by injecting...

ActiveWeb Contentserver CMS 5.6.2929 - Client-Side Filtering Bypass

source: https://www.securityfocus.com/bid/24898/info activeWeb contentserver is prone to a client-side input-validation vulnerability because the application fails to sufficiently sanitize user-supplied data. An attacker can exploit these input-validation vulnerabilities to perform various attack...

contentserver 5.6.2929 - '/errors/rights.asp?msg' Cross-Site Scripting

source: https://www.securityfocus.com/bid/24895/info activeWeb contentserver is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of a...

[Full-disclosure] ActiveWeb Contentserver CMS Clientside Filtering of Page Editor Content

Advisory: ActiveWeb Contentserver CMS Clientside Filtering of Page Editor Content RedTeam Pentesting discovered a design vulnerability in the page editor of the activeWeb contentserver CMS during a penetration test. Filtering of user content, e.g. to prevent the usage of Javascript code, is done ...

Re: [Full-disclosure] ActiveWeb Contentserver CMS Multiple Cross Site Scriptings

didn't find this in your list. Work for their online demo site not sure if it works in actual deployment -...

[Full-disclosure] ActiveWeb Contentserver CMS Multiple Cross Site Scriptings

Advisory: ActiveWeb Contentserver CMS Multiple Cross Site Scriptings RedTeam Pentesting discovered three Cross Site Scripting vulnerabilities in the activeWeb contentserver CMS during a penetration test. One of the Cross Site Scriptings is persistent. Details ======= Product: activeWeb...

rt-sa-2007-005.txt

Advisory: ActiveWeb Contentserver CMS Multiple Cross Site Scriptings RedTeam Pentesting discovered three Cross Site Scripting vulnerabilities in the activeWeb contentserver CMS during a penetration test. One of the Cross Site Scriptings is persistent. Details ======= Product: activeWeb...

contentserver 5.6.2929 - '/errors/transaction.asp?msg' Cross-Site Scripting

source: https://www.securityfocus.com/bid/24895/info activeWeb contentserver is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of a...

[Full-disclosure] ActiveWeb Contentserver CMS Editor Permission Settings Problem

Advisory: ActiveWeb Contentserver CMS Editor Permission Settings Problem RedTeam Pentesting discovered a problem with the permission settings in the management interface of the activeWeb contentserver CMS during a penetration test. The ability of an editor to create and edit documents can be...

ActiveWeb Contentserver 5.6.2929 - Picture_Real_Edit.asp SQL Injection

ActiveWeb Contentserver 5.6.2929 - PictureRealEdit.asp SQL Injection source: https://www.securityfocus.com/bid/24894/info activeWeb contentserver is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. A...

ActiveWeb Contentserver CMS 5.6.2929 - Client-Side Filtering Bypass

ActiveWeb Contentserver CMS 5.6.2929 - Client-Side Filtering Bypass source: https://www.securityfocus.com/bid/24898/info activeWeb contentserver is prone to a client-side input-validation vulnerability because the application fails to sufficiently sanitize user-supplied data. An attacker can...