CVE-2002-0539 Demarc PureSecure 1.05 allows remote attackers to gain administrative privileges via a SQL injection attack in a session ID that is stored in the s_key cookie.
HighCVSS 10.0
EPSS 2.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Demarc PureSecure 1.05 allows remote attackers to gain administrative privileges via a SQL injection attack in a session ID that is stored in the s_key cookie.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| demarc security puresecure | = 1.0.5_for_unix | No fix listed |
| demarc security puresecure | = 1.0.5_for_windows | No fix listed |
References
- 20020415 Demarc PureSecure 1.05 may be other (user can bypass login) exploit mailing-list patch vendor-advisory
- 20020417 Demarc Security Update Advisory mailing-list patch
- puresecure-sql-injection(8854) patch vdb-entry vendor-advisory
- 5239 vdb-entry
- 4520 exploit patch vdb-entry vendor-advisory