PT-2003-1574 · Port80 · Iisprotect

Gyrniff + 1 · Publicado 2003-06-06 · Atualizado 2024-02-13 · CVE-2003-0377

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: iisPROTECT versions 2.2-r4 and earlier

Description: The issue allows remote attackers to insert arbitrary SQL and execute code via certain variables, such as the GroupName variable in the SiteAdmin.ASP page. This can be exploited by attackers to gain unauthorized access.

Recommendations: For iisPROTECT versions 2.2-r4 and earlier, consider restricting access to the SiteAdmin.ASP page and avoid using the GroupName variable until a fix is available. As a temporary workaround, restrict the use of variables that can be used for SQL injection in the web-based administration interface.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2003-0377

Produtos afetados

Iisprotect

Referências · 4

• 🔥 https://exploit-db.com/exploits/22639 · Exploit
• https://t.me/cvenotify/71258 · Publicação no Telegram
• http://marc.info/?l=bugtraq&m=105370528728225&w=2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2003-0377 · Nota de Segurança