PT-2005-4931 · Quickpaypro · Quickpaypro

Published 2005-12-15 · Updated 2011-03-08 · CVE-2005-4243

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions QuickPayPro version 3.1

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved through SQL injection vulnerabilities in various parameters, including the popupid parameter in "popups.edit.php", so, sb, and nr parameters in "customer.tickets.view.php", subrackingid parameter in "subscribers.tracking.edit.php", delete parameter in "design.php", trackingid parameter in "tracking.details.php", and customerid parameter in "sales.view.php".

Recommendations For QuickPayPro version 3.1, consider restricting access to the affected parameters, such as popupid, so, sb, nr, subrackingid, delete, trackingid, and customerid, until a patch is available. As a temporary workaround, avoid using these parameters in the respective API endpoints.

Exploit

Fix

Related Identifiers

CVE-2005-4243

Affected Products

Quickpaypro

References · 17

• 🔥 http://osvdb.org/21679 · Exploit
• 🔥 https://exploit-db.com/exploits/26830 · Exploit
• 🔥 http://osvdb.org/21676 · Exploit
• 🔥 https://exploit-db.com/exploits/26827 · Exploit
• 🔥 https://exploit-db.com/exploits/26831 · Exploit
• 🔥 http://osvdb.org/21677 · Exploit
• 🔥 https://exploit-db.com/exploits/26828 · Exploit
• 🔥 http://osvdb.org/21680 · Exploit
• 🔥 http://osvdb.org/21681 · Exploit
• 🔥 http://osvdb.org/21678 · Exploit
• 🔥 https://exploit-db.com/exploits/26832 · Exploit
• 🔥 https://exploit-db.com/exploits/26829 · Exploit
• http://secunia.com/advisories/17981 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-4243 · Security Note
• http://securityfocus.com/bid/15863 · Note