PT-2005-2234 · Ecommpro · Ecommpro

C0D3R + 1 · Published 2005-04-22 · Updated 2024-02-14 · CVE-2005-1221

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions EcommPro version 3.0

Description The issue allows remote attackers to execute arbitrary SQL commands via the password field in the login.asp file. This can potentially lead to unauthorized access and data manipulation.

Recommendations For EcommPro version 3.0, consider validating and sanitizing user input in the password field to prevent SQL injection attacks. As a temporary workaround, restrict access to the login.asp file until a proper fix is applied.

Exploit

Fix

Related Identifiers

CVE-2005-1221

Affected Products

Ecommpro

References · 4

• 🔥 http://ihssecurity.com/download/advisory/ecomerce-cart.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-1221 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/20200 · Note
• http://marc.info/?l=bugtraq&m=111402179605925&w=2 · Note