PT-2001-1544 · Ibm · Ibm Net.Commerce

Published 2001-05-03 · Updated 2017-10-10 · CVE-2001-0319

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions IBM Net.Commerce versions 3.x

Description The issue allows remote attackers to execute arbitrary SQL queries by inserting them into the order rn option of the report capability. This is made possible through the orderdspc.d2w macro.

Recommendations For IBM Net.Commerce versions 3.x, consider restricting access to the report capability to minimize the risk of exploitation. As a temporary workaround, avoid using the order rn option in the report capability until a fix is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Related Identifiers

CVE-2001-0319

Affected Products

Ibm Net.Commerce

References · 6

• 🔥 https://exploit-db.com/exploits/20618 · Exploit
• 🔥 http://archives.neohapsis.com/archives/bugtraq/2001-02/0072.html · Exploit
• http://www-4.ibm.com/software/webservers/commerce/netcomletter.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2001-0319 · Security Note
• http://securityfocus.com/bid/2350 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/6067 · Note