Lucene search

[email protected]CVE-2004-2324

HistoryAug 16, 2005 - 4:00 a.m.

CVE-2004-2324

2005-08-1604:00:00

[email protected]

web.nvd.nist.gov

cve-2004-2324

sql injection

dotnetnuke

remote attackers

database modification

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

8.1 High

AI Score

Confidence

Low

0.006 Low

EPSS

Percentile

79.5%

JSON

SQL injection vulnerability in DotNetNuke (formerly IBuySpy Workshop) 1.0.6 through 1.0.10d allows remote attackers to modify the backend database via the (1) table and (2) field parameters in LinkClick.aspx.

Affected configurations

NVD

Node

dotnetnukedotnetnukeMatch1.0.6

dotnetnukedotnetnukeMatch1.0.7

dotnetnukedotnetnukeMatch1.0.8

dotnetnukedotnetnukeMatch1.0.9

dotnetnukedotnetnukeMatch1.0.10d

CPENameOperatorVersion
dotnetnuke:dotnetnukedotnetnukeeq1.0.6
dotnetnuke:dotnetnukedotnetnukeeq1.0.7
dotnetnuke:dotnetnukedotnetnukeeq1.0.8
dotnetnuke:dotnetnukedotnetnukeeq1.0.9
dotnetnuke:dotnetnukedotnetnukeeq1.0.10d

CPE	Name	Operator	Version
dotnetnuke:dotnetnuke	dotnetnuke	eq	1.0.6
dotnetnuke:dotnetnuke	dotnetnuke	eq	1.0.7
dotnetnuke:dotnetnuke	dotnetnuke	eq	1.0.8
dotnetnuke:dotnetnuke	dotnetnuke	eq	1.0.9
dotnetnuke:dotnetnuke	dotnetnuke	eq	1.0.10d

References

archives.neohapsis.com/archives/fulldisclosure/2004-01/1161.html

secunia.com/advisories/10747

www.osvdb.org/3750

www.securityfocus.com/bid/9518

exchange.xforce.ibmcloud.com/vulnerabilities/14973

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

8.1 High

AI Score

Confidence

Low

0.006 Low

EPSS

Percentile

79.5%

JSON

Related for CVE-2004-2324

nvd1 cvelist1