Expinion.net News Manager Lite Multiple漏洞

Expinion.net News Manager Lite Multiple漏洞

漏洞ID 1107808 漏洞类型 SQL注入
发布时间 2004-03-20 更新时间 2005-10-20
图片[1]-Expinion.net News Manager Lite Multiple漏洞-安全小百科CVE编号 CVE-2004-1846
图片[2]-Expinion.net News Manager Lite Multiple漏洞-安全小百科CNNVD-ID CNNVD-200403-090
漏洞平台 ASP CVSS评分 7.5
|漏洞来源
https://www.exploit-db.com/exploits/23862
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200403-090
|漏洞详情
NewsManagerLite2.5版本存在多个SQL注入漏洞。远程攻击者借助(1)more.asp的ID参数,(2)category_news.asp的ID参数,或(3)news_sort.asp的filter参数执行任意SQL代码。
|漏洞EXP
source: http://www.securityfocus.com/bid/9935/info
    
Multiple vulnerabilities have been identified in the application that may allow an attacker to carry out SQL injection, cross-site scripting, and account hijacking attacks.
    
The issues exist in the 'comment_add.asp', 'search.asp', 'category_news_headline.asp', 'more.asp', 'category_news.asp', and 'ews_sort.asp' scripts. Further more a cookie account hijacking issue was also discovered in the application that may allow a remote attacker to gain administrative access to application's administrative interface.
    
News Manager Lite 2.5 is reported to be affected by these issues, however, other versions may be affected as well.

http://www.example.com/news_sort.asp?filter='[SQL]
|参考资料

来源:BID
名称:9935
链接:http://www.securityfocus.com/bid/9935
来源:SECTRACK
名称:1009507
链接:http://securitytracker.com/id?1009507
来源:XF
名称:news-manager-sql-injection(15549)
链接:http://xforce.iss.net/xforce/xfdb/15549
来源:OSVDB
名称:4497
链接:http://www.osvdb.org/4497
来源:OSVDB
名称:4496
链接:http://www.osvdb.org/4496
来源:OSVDB
名称:4495
链接:http://www.osvdb.org/4495
来源:SECUNIA
名称:11180
链接:http://secunia.com/advisories/11180
来源:BUGTRAQ
名称:20040322VulnerabilitiesinNewsManagerLite2.5&NewsManagerLiteadministration;
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=107999733503496&w;=2

相关推荐: LionMax Software Chat Anywhere User IP Address Obfuscation Vulnerability

LionMax Software Chat Anywhere User IP Address Obfuscation Vulnerability 漏洞ID 1098813 漏洞类型 Input Validation Error 发布时间 2004-03-09 …

© 版权声明
THE END
喜欢就支持一下吧
点赞0
分享