CVE-2004-0374 Interchange before 5.0.1 allows remote attackers to "expose the content of arbitrary variables" and read or modify sensitive SQL information via an HTTP request ending with the "SQLUSER" string.
MediumCVSS 6.4
EPSS 2.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Interchange before 5.0.1 allows remote attackers to "expose the content of arbitrary variables" and read or modify sensitive SQL information via an HTTP request ending with the "SQLUSER" string.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| interchange development group interchange | = 4.8.1 | No fix listed |
| interchange development group interchange | = 4.8.2 | No fix listed |
| interchange development group interchange | = 4.8.3 | No fix listed |
| interchange development group interchange | = 4.8.4 | No fix listed |
| interchange development group interchange | = 4.8.5 | No fix listed |
| interchange development group interchange | = 4.8.6 | No fix listed |
| interchange development group interchange | = 4.8.7 | No fix listed |
| interchange development group interchange | = 4.8.8 | No fix listed |
| interchange development group interchange | = 4.8.9 | No fix listed |
| interchange development group interchange | = 5.0 | No fix listed |
References
- ftp.icdevgroup.org
- 11234 third-party-advisory
- DSA-471 patch vendor-advisory
- [interchange-announce] 20040329 Security Problem in Interchange mailing-list
- 10005 vdb-entry
- interchange-url-obtain-information(15670) vdb-entry