PT-2003-1235 · Factosystem · Factosystem Cms

Publicado 2003-03-18 · Atualizado 2008-09-05 · CVE-2002-1499

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions FactoSystem CMS (affected versions not specified)

Description The issue allows remote attackers to perform unauthorized database actions due to multiple SQL injection vulnerabilities. These vulnerabilities can be exploited via specific parameters in various ASP files, including:

• the authornumber parameter in "author.asp"
• the discussblurbid parameter in "discuss.asp"
• the name parameter in "holdcomment.asp"
• the email parameter in "holdcomment.asp".

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2002-1499

Produtos afetados

Factosystem Cms

Referências · 7

• 🔥 https://exploit-db.com/exploits/21766 · Exploit
• 🔥 http://online.securityfocus.com/archive/1/290021 · Exploit
• 🔥 http://securityfocus.com/bid/5600 · Exploit
• http://iss.net/security_center/static/10000.php · Aviso do Fabricante
• http://sourceforge.net/tracker/index.php?func=detail&aid=602711&group_id=12668&atid=112668 · Nota
• http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0097.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2002-1499 · Nota de Segurança