PT-2003-1574 · Port80 · Iisprotect

Gyrniff + 1 · Published 2003-06-06 · Updated 2024-02-13 · CVE-2003-0377

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: iisPROTECT versions 2.2-r4 and earlier

Description: The issue allows remote attackers to insert arbitrary SQL and execute code via certain variables, such as the GroupName variable in the SiteAdmin.ASP page. This can be exploited by attackers to gain unauthorized access.

Recommendations: For iisPROTECT versions 2.2-r4 and earlier, consider restricting access to the SiteAdmin.ASP page and avoid using the GroupName variable until a fix is available. As a temporary workaround, restrict the use of variables that can be used for SQL injection in the web-based administration interface.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2003-0377

Affected Products

Iisprotect

References · 4

• 🔥 https://exploit-db.com/exploits/22639 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2003-0377 · Security Note
• https://t.me/cvenotify/71258 · Telegram Post
• http://marc.info/?l=bugtraq&m=105370528728225&w=2 · Note