CVE-2005-2062 Multiple SQL injection vulnerabilities in ActiveBuyAndSell 6.2 allow remote attackers to execute arbitrary SQL commands via the catid parameter to (1) default.asp or (2) buyersend.asp, (3) Administrat...
HighCVSS 7.5
EPSS 1.3%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple SQL injection vulnerabilities in ActiveBuyAndSell 6.2 allow remote attackers to execute arbitrary SQL commands via the catid parameter to (1) default.asp or (2) buyersend.asp, (3) Administrator ID field in admin.asp, E-mail field in (4) advertiserstart.asp or (5) buyer.asp, or Keyword field in search.asp.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| active web softwares activebuyandsell | = 6.2 | No fix listed |
References
- echo.or.id
- 20050624 [ECHO_ADV_21$2005] MUltiple Vulnarable In ActiveBuyAndSell mailing-list
- 23110 vdb-entry
- ADV-2007-1096 vdb-entry
- activebuyandsell-buyersend-sql-injection(33183) vdb-entry
- 3550 exploit