CVE-2005-1029

Multiple SQL injection vulnerabilities in Active Auction House allow remote attackers to execute arbitrary SQL commands via the (1) catid, (2) SortDir, or (3) Sortby parameter to default.asp, (4) itemID parameter to ItemInfo.asp, or (5) Email field to sendpassword.asp.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://digitalparadox.org/advisories/aass.txt
http://marc.info/?l=bugtraq&m=111280834000432&w=2
http://secunia.com/advisories/14839	Vendor Advisory
http://www.osvdb.org/15281
http://www.osvdb.org/15282
http://www.osvdb.org/15283
http://www.securityfocus.com/bid/13032	Exploit Vendor Advisory
http://www.securityfocus.com/bid/13034	Exploit Vendor Advisory
http://www.securityfocus.com/bid/13035	Vendor Advisory
http://www.securitytracker.com/alerts/2005/Apr/1013649.html	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/19977

Configurations

Configuration 1 (hide)

cpe:2.3:a:active_web_softwares:active_auction_house:7.1:*:pro:*:*:*:*:*

History

No history.

Information

Published : 2005-04-06 04:00

Updated : 2017-07-11 01:32

NVD link : CVE-2005-1029

Mitre link : CVE-2005-1029

CVE.ORG link : CVE-2005-1029

JSON object : View

Products Affected

active_web_softwares

active_auction_house

CWE

NVD-CWE-Other

{"id": "CVE-2005-1029", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}]}, "published": "2005-04-06T04:00:00.000", "references": [{"url": "http://digitalparadox.org/advisories/aass.txt", "source": "cve@mitre.org"}, {"url": "http://marc.info/?l=bugtraq&m=111280834000432&w=2", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/14839", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.osvdb.org/15281", "source": "cve@mitre.org"}, {"url": "http://www.osvdb.org/15282", "source": "cve@mitre.org"}, {"url": "http://www.osvdb.org/15283", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/13032", "tags": ["Exploit", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/13034", "tags": ["Exploit", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/13035", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securitytracker.com/alerts/2005/Apr/1013649.html", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/19977", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Multiple SQL injection vulnerabilities in Active Auction House allow remote attackers to execute arbitrary SQL commands via the (1) catid, (2) SortDir, or (3) Sortby parameter to default.asp, (4) itemID parameter to ItemInfo.asp, or (5) Email field to sendpassword.asp."}], "lastModified": "2017-07-11T01:32:30.203", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:active_web_softwares:active_auction_house:7.1:*:pro:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F403D596-4206-4B53-9796-BAA23A68B47D"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}