CVE-2004-2175
published 2004-12-31CVE-2004-2175: Multiple SQL injection vulnerabilities in ReviewPost PHP Pro allow remote attackers to execute arbitrary SQL commands via the (1) product parameter to…
PriorityP336high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
1.24%
65.4th percentile
Multiple SQL injection vulnerabilities in ReviewPost PHP Pro allow remote attackers to execute arbitrary SQL commands via the (1) product parameter to showproduct.php or (2) cat parameter to showcat.php.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| all_enthusiast_inc | reviewpost_php_pro | — | — |
| all_enthusiast_inc | reviewpost_php_pro | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
All Enthusiast ReviewPost PHP Pro 2.5 - 'showcat.php' SQL Injection
exploitdb·2004-02-04
CVE-2004-2175 All Enthusiast ReviewPost PHP Pro 2.5 - 'showcat.php' SQL Injection
All Enthusiast ReviewPost PHP Pro 2.5 - 'showcat.php' SQL Injection
---
source: https://www.securityfocus.com/bid/9574/info
It has been reported that ReviewPost PHP Pro may be prone to multiple SQL injection vulnerabilities that may allow an attacker to influence SQL query logic. This issue could be exploited to disclose sensitive information that may be used to gain unauthorized access. An attacker may pass malicious data via the 'product' parameter of 'showproduct.php' script and the 'cat' parameter of 'showcat.php' script.
Although unconfirmed, ReviewPost PHP Pro 2.5.1 and prior may be prone to these issues.
http://www.example.com/directory/showcat.php?cat=[query]
Exploit-DB
All Enthusiast ReviewPost PHP Pro 2.5 - 'showproduct.php' SQL Injection
exploitdb·2004-02-04
CVE-2004-2175 All Enthusiast ReviewPost PHP Pro 2.5 - 'showproduct.php' SQL Injection
All Enthusiast ReviewPost PHP Pro 2.5 - 'showproduct.php' SQL Injection
---
source: https://www.securityfocus.com/bid/9574/info
It has been reported that ReviewPost PHP Pro may be prone to multiple SQL injection vulnerabilities that may allow an attacker to influence SQL query logic. This issue could be exploited to disclose sensitive information that may be used to gain unauthorized access. An attacker may pass malicious data via the 'product' parameter of 'showproduct.php' script and the 'cat' parameter of 'showcat.php' script.
Although unconfirmed, ReviewPost PHP Pro 2.5.1 and prior may be prone to these issues.
http://www.example.com/directory/showproduct.php?product=[query]
No writeups or analysis indexed.
http://secunia.com/advisories/10786/http://www.securityfocus.com/archive/1/352598http://www.securityfocus.com/bid/9574http://www.zone-h.org/en/advisories/read/id=3864/https://exchange.xforce.ibmcloud.com/vulnerabilities/15035http://secunia.com/advisories/10786/http://www.securityfocus.com/archive/1/352598http://www.securityfocus.com/bid/9574http://www.zone-h.org/en/advisories/read/id=3864/https://exchange.xforce.ibmcloud.com/vulnerabilities/15035
2004-12-31
Published