CVE-2005-4486
published 2005-12-22CVE-2005-4486: SQL injection vulnerability in Quantum Art QP7.Enterprise (formerly Q-Publishing) allows remote attackers to execute arbitrary SQL commands via the p_news_id…
PriorityP335high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
1.17%
63.5th percentile
SQL injection vulnerability in Quantum Art QP7.Enterprise (formerly Q-Publishing) allows remote attackers to execute arbitrary SQL commands via the p_news_id parameter to (1) news_and_events_new.asp and (2) news.asp. NOTE: on 20060227, the vendor disputed the accuracy of this report, saying that the p_news_id, news_and_events_new.asp, and news.asp are not specifically part of their product, although they could be dynamically generated through use of the product. Some investigation by CVE suggests evidence that the news_and_events_new.asp page has at least a forced invalid SQL syntax error, but this could not be repeated for news.asp
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Quantum Art QP7.Enterprise - 'news.asp?p_news_id' SQL Injection
exploitdb·2005-12-21
CVE-2005-4486 Quantum Art QP7.Enterprise - 'news.asp?p_news_id' SQL Injection
Quantum Art QP7.Enterprise - 'news.asp?p_news_id' SQL Injection
---
source: https://www.securityfocus.com/bid/16022/info
QP7.Enterprise is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
http://www.example.com/news.asp?p_pagealias=news&p_news_id=1[SQL]
Exploit-DB
Quantum Art QP7.Enterprise - 'news_and_events_new.asp?p_news_id' SQL Injection
exploitdb·2005-12-21
CVE-2005-4486 Quantum Art QP7.Enterprise - 'news_and_events_new.asp?p_news_id' SQL Injection
Quantum Art QP7.Enterprise - 'news_and_events_new.asp?p_news_id' SQL Injection
---
source: https://www.securityfocus.com/bid/16022/info
QP7.Enterprise is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
http://www.example.com/news_and_events_new.asp?p_MenuAlias=news&p_news_id=1[SQL]
No writeups or analysis indexed.
http://pridels0.blogspot.com/2005/12/qp7enterprise-sql-vuln.htmlhttp://www.osvdb.org/22069http://www.osvdb.org/22070http://www.securityfocus.com/bid/16022http://pridels0.blogspot.com/2005/12/qp7enterprise-sql-vuln.htmlhttp://www.osvdb.org/22069http://www.osvdb.org/22070http://www.securityfocus.com/bid/16022
2005-12-22
Published