CVE-2004-1647

EPSS 1.2%

SQL injection vulnerability in Password Protect allows remote attackers to execute arbitrary SQL statements and bypass authentication via (1) admin or Pass parameter to index_next.asp, (2) LoginId, OPass, or NPass to CPassChangePassword.asp, (3) users_edit.asp, or (4) users_add.asp.

Affected products

n/a · n/a

public PoCs found — 1

exploitdbwww.exploit-db.com/exploits/24420unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://marc.info/?l=bugtraq&m=109414967003192&w=2 http://secunia.com/advisories/12407 https://exchange.xforce.ibmcloud.com/vulnerabilities/17188 http://www.criolabs.net/advisories/passprotect.txt http://www.securityfocus.com/bid/11073