CVE-2005-1029 Multiple SQL injection vulnerabilities in Active Auction House allow remote attackers to execute arbitrary SQL commands via the (1) catid, (2) SortDir, or (3) Sortby parameter to default.asp, (4) item...
HighCVSS 7.5
EPSS 4.3%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple SQL injection vulnerabilities in Active Auction House allow remote attackers to execute arbitrary SQL commands via the (1) catid, (2) SortDir, or (3) Sortby parameter to default.asp, (4) itemID parameter to ItemInfo.asp, or (5) Email field to sendpassword.asp.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| active web softwares active auction house | = 7.1 | No fix listed |
References
- digitalparadox.org
- 20050406 Active Auction House has multiple Sql injection, error and XSS mailing-list
- 14839 third-party-advisory vendor-advisory
- 15281 vdb-entry
- 15282 vdb-entry
- 15283 vdb-entry
- 13032 exploit vdb-entry vendor-advisory
- 13034 exploit vdb-entry vendor-advisory
- 13035 vdb-entry vendor-advisory
- 1013649 vdb-entry vendor-advisory
- aah-multiple-scripts-sql-injection(19977) vdb-entry