PT-2003-1235 · Factosystem · Factosystem Cms

Published 2003-03-18 · Updated 2008-09-05 · CVE-2002-1499

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions FactoSystem CMS (affected versions not specified)

Description The issue allows remote attackers to perform unauthorized database actions due to multiple SQL injection vulnerabilities. These vulnerabilities can be exploited via specific parameters in various ASP files, including:

• the authornumber parameter in "author.asp"
• the discussblurbid parameter in "discuss.asp"
• the name parameter in "holdcomment.asp"
• the email parameter in "holdcomment.asp".

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2002-1499

Affected Products

Factosystem Cms

References · 7

• 🔥 https://exploit-db.com/exploits/21766 · Exploit
• 🔥 http://online.securityfocus.com/archive/1/290021 · Exploit
• 🔥 http://securityfocus.com/bid/5600 · Exploit
• http://iss.net/security_center/static/10000.php · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-1499 · Security Note
• http://sourceforge.net/tracker/index.php?func=detail&aid=602711&group_id=12668&atid=112668 · Note
• http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0097.html · Note