CVE-2003-0509
published 2003-08-07CVE-2003-0509: SQL injection vulnerability in Cyberstrong eShop 4.2 and earlier allows remote attackers to steal authentication information and gain privileges via the…
PriorityP346critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
5.85%
92.3th percentile
SQL injection vulnerability in Cyberstrong eShop 4.2 and earlier allows remote attackers to steal authentication information and gain privileges via the ProductCode parameter in (1) 10expand.asp, (2) 10browse.asp, and (3) 20review.asp.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cyberstrong | eshop | <= 4.2 | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
CyberStrong eShop 4.2 - '10expand.asp' SQL Injection
exploitdb·2005-06-30
CVE-2003-0509 CyberStrong eShop 4.2 - '10expand.asp' SQL Injection
CyberStrong eShop 4.2 - '10expand.asp' SQL Injection
---
source: https://www.securityfocus.com/bid/14103/info
CyberStrong eShop is prone to an SQL injection vulnerability. As a result, the attacker may modify the structure and logic of an SQL query that is made by the application. The attacker may accomplish this by passing malicious SQL syntax to the vulnerable '10expand.asp' script.
It is reported that the attacker may steal eShop authentication information. Other attacks may be possible depending on the capabilities of the underlying database and the nature of the affected query.
http://www.example.com/eshop/10expand.asp?ProductCode='
Exploit-DB
CyberStrong EShop 4.2 - '20review.asp' SQL Injection
exploitdb·2005-06-30
CVE-2003-0509 CyberStrong EShop 4.2 - '20review.asp' SQL Injection
CyberStrong EShop 4.2 - '20review.asp' SQL Injection
---
source: https://www.securityfocus.com/bid/14101/info
CyberStrong eShop is prone to an SQL-injection vulnerability. As a result, the attacker may modify the structure and logic of an SQL query that is made by the application. The attacker may accomplish this by passing malicious SQL syntax to the vulnerable '20review.asp' script.
Reportedly, the attacker may steal eShop authentication information. Other attacks may be possible, depending on the capabilities of the underlying database and the nature of the affected query.
http://www.example.com/eshop/20Review.asp?ProductCode='
No writeups or analysis indexed.
http://marc.info/?l=bugtraq&m=105709450711395&w=2http://secunia.com/advisories/9165http://securitytracker.com/id?1007092http://www.osvdb.org/10098http://www.osvdb.org/10099http://www.osvdb.org/10100http://www.securityfocus.com/bid/14101http://www.securityfocus.com/bid/14103http://www.securityfocus.com/bid/14112https://exchange.xforce.ibmcloud.com/vulnerabilities/12485http://marc.info/?l=bugtraq&m=105709450711395&w=2http://secunia.com/advisories/9165http://securitytracker.com/id?1007092http://www.osvdb.org/10098http://www.osvdb.org/10099http://www.osvdb.org/10100http://www.securityfocus.com/bid/14101http://www.securityfocus.com/bid/14103http://www.securityfocus.com/bid/14112https://exchange.xforce.ibmcloud.com/vulnerabilities/12485
2003-08-07
Published