PT-2004-3452 · Wecenter · Webcenter

Published 2004-12-31 · Updated 2017-07-11 · CVE-2004-2561

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Web+Center version 4.0.1

Description The issue concerns SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands. This can be achieved via the ISS TECH CENTER LOGIN cookie in the "search.asp" endpoint and one or more cookies in the "DoCustomerOptions.asp" endpoint. The estimated number of potentially affected devices and details about real-world incidents are not specified.

Recommendations For Web+Center version 4.0.1, consider restricting access to the search.asp and DoCustomerOptions.asp endpoints until a fix is available. As a temporary workaround, avoid using the ISS TECH CENTER LOGIN cookie in these endpoints to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2004-2561

Affected Products

Webcenter

References · 7

• 🔥 http://osvdb.org/8180 · Exploit
• 🔥 http://securiteam.com/windowsntfocus/5RP0N0ADGK.html · Exploit
• 🔥 http://securityfocus.com/bid/10771 · Exploit
• 🔥 https://exploit-db.com/exploits/24298 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-2561 · Security Note
• http://secunia.com/advisories/12121 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16775 · Note