CVE-2005-3978
published 2005-12-03CVE-2005-3978: Multiple SQL injection vulnerabilities in NetClassifieds Premium Edition 1.0.1, Professional Edition 1.5.1, Standard Edition 1.9.6.3, and Free Edition 1.0.1…
PriorityP339high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
2.73%
84.2th percentile
Multiple SQL injection vulnerabilities in NetClassifieds Premium Edition 1.0.1, Professional Edition 1.5.1, Standard Edition 1.9.6.3, and Free Edition 1.0.1 allow remote attackers to execute arbitrary SQL commands via the (1) CatID parameter in (a) ViewCat.php and (b) gallery.php, and the (2) ItemNum parameter in (c) ViewItem.php.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| scriptdevelopers.net | netclassifieds | — | — |
| scriptdevelopers.net | netclassifieds | — | — |
| scriptdevelopers.net | netclassifieds | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-5cmm-cmgf-4vfr: Multiple SQL injection vulnerabilities in NetClassifieds Premium Edition allow remote attackers to execute arbitrary SQL commands via the s_user_id pa
ghsa_unreviewed·2022-05-01·CVSS 7.5
CVE-2007-3354 [HIGH] GHSA-5cmm-cmgf-4vfr: Multiple SQL injection vulnerabilities in NetClassifieds Premium Edition allow remote attackers to execute arbitrary SQL commands via the s_user_id pa
Multiple SQL injection vulnerabilities in NetClassifieds Premium Edition allow remote attackers to execute arbitrary SQL commands via the s_user_id parameter to ViewCat.php and other unspecified vectors. NOTE: the CatID/ViewCat.php, CatID/gallery.php, and ItemNum/ViewItem.php vectors are already covered by CVE-2005-3978.
GHSA
GHSA-8jf5-j23h-mq23: Multiple SQL injection vulnerabilities in NetClassifieds Premium Edition 1
ghsa_unreviewed·2022-05-01
CVE-2005-3978 [HIGH] GHSA-8jf5-j23h-mq23: Multiple SQL injection vulnerabilities in NetClassifieds Premium Edition 1
Multiple SQL injection vulnerabilities in NetClassifieds Premium Edition 1.0.1, Professional Edition 1.5.1, Standard Edition 1.9.6.3, and Free Edition 1.0.1 allow remote attackers to execute arbitrary SQL commands via the (1) CatID parameter in (a) ViewCat.php and (b) gallery.php, and the (2) ItemNum parameter in (c) ViewItem.php.
No detection rules found.
Exploit-DB
NetClassifieds - SQL Injection / Cross-Site Scripting / Full Path
exploitdb·2007-06-22
CVE-2005-3978 NetClassifieds - SQL Injection / Cross-Site Scripting / Full Path
NetClassifieds - SQL Injection / Cross-Site Scripting / Full Path
---
Application: NetClassifieds:
-Free Edition
-Standard Edition
-Professional Edition
-Premium Edition
Web Site: http://www.scriptdevelopers.net/
Versions: all
Platform: linux, windows
Bug: multiple injection sql , xss , full path
Fix Available: Yes
1) Introduction
2) Bug
3) The Code
4) Proof of concept
5) Fix
6)Conclusion
1) Introduction
"NetClassifieds Premium Edition has been built on the premise of making every
classifieds site feel like it was custom written for the purpose for which it's being used.
Automotive Sites, Horse Sites, Reality Sites, General Classifieds Sites or any other type
of classifieds site you can think of will find a perfect match in NetClassifieds"
2) Bug
injection sql , xss , full path
3
Exploit-DB
NetClassifieds Standard 1.9/Professional 1.5/Premium 1.0 - 'gallery.php?CatID' SQL Injection
exploitdb·2005-12-02
CVE-2005-3978 NetClassifieds Standard 1.9/Professional 1.5/Premium 1.0 - 'gallery.php?CatID' SQL Injection
NetClassifieds Standard 1.9/Professional 1.5/Premium 1.0 - 'gallery.php?CatID' SQL Injection
---
source: https://www.securityfocus.com/bid/15683/info
NetClassifieds is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.
http://www.example.com/gallery.php?CatID=[SQL]
Exploit-DB
NetClassifieds Standard 1.9/Professional 1.5/Premium 1.0 - 'ViewItem.php?ItemNum' SQL Injection
exploitdb·2005-12-02
CVE-2005-3978 NetClassifieds Standard 1.9/Professional 1.5/Premium 1.0 - 'ViewItem.php?ItemNum' SQL Injection
NetClassifieds Standard 1.9/Professional 1.5/Premium 1.0 - 'ViewItem.php?ItemNum' SQL Injection
---
source: https://www.securityfocus.com/bid/15683/info
NetClassifieds is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.
http://www.example.com/ViewItem.php?ItemNum=[SQL]
No writeups or analysis indexed.
http://pridels0.blogspot.com/2005/12/netclassifieds-all-versions-sql-inj.htmlhttp://secunia.com/advisories/17853http://www.osvdb.org/21378http://www.osvdb.org/21379http://www.osvdb.org/21380http://www.securityfocus.com/bid/15683http://www.vupen.com/english/advisories/2005/2689http://pridels0.blogspot.com/2005/12/netclassifieds-all-versions-sql-inj.htmlhttp://secunia.com/advisories/17853http://www.osvdb.org/21378http://www.osvdb.org/21379http://www.osvdb.org/21380http://www.securityfocus.com/bid/15683http://www.vupen.com/english/advisories/2005/2689
2005-12-03
Published