CVE-2005-4606 SQL injection vulnerability in check_user.asp in multiple Web Wiz products including (1) Site News 3.06 and earlier, (2) Journal 1.0 and earlier, (3) Polls 3.06 and earlier, and (4) and Database Login...
HighCVSS 7.5
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
SQL injection vulnerability in check_user.asp in multiple Web Wiz products including (1) Site News 3.06 and earlier, (2) Journal 1.0 and earlier, (3) Polls 3.06 and earlier, and (4) and Database Login 1.71 and earlier allows remote attackers to execute arbitrary SQL commands via the txtUserName parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| webwiz database login | <= 1.71 | No fix listed |
| webwiz journal | <= 1.0 | No fix listed |
| webwiz site news | <= 3.06 | No fix listed |
| webwiz site news | = 2.00 | No fix listed |
| webwiz weekly poll | <= 3.06 | No fix listed |
References
- 18263 patch third-party-advisory vendor-advisory
- 305 third-party-advisory
- 22148 vdb-entry
- 20051230 [KAPDA::#18] - WebWiz Products SQL Injection mailing-list
- 16085 exploit vdb-entry
- ADV-2006-0007 vdb-entry