ASP-CMS SQL Injection via commentList.asp id Parameter
63Vexday Risk Score
Priorize a correção. Ela exploração observada pelo VulnCheck e tem prova de conceito pública.
ssvc Actcvss 8.7epss 0.6%
da publicação à arma
Publicada no NVD13 de ago.
VulnCheck13 de ago.
probabilidade de exploração
0.6%top 55% das CVEs
exploração observada
simVulnCheck
1 exploit(s) público(s)
ASP-CMS contains a SQL injection vulnerability in the commentList.asp endpoint that allows unauthenticated remote attackers to inject arbitrary SQL by manipulating the id parameter in GET requests to the comment listing script. Attackers can bypass the application's keyword blocklist by interleaving the string 'master' within blocked SQL terms to extract sensitive database contents. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18 (UTC).
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
ASP-CMS Project · ASP-CMSPoCs públicas encontradas — 1
cve_referenceweb.archive.org/web/20201001011935/https://www.safeinfo.me/2019/07/22/aspcms-lou-dong-ji-he.htmlnão verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
Referências
https://github.com/projectdiscovery/nuclei-templates/issues/7968https://web.archive.org/web/20201001011935/https://www.safeinfo.me/2019/07/22/aspcms-lou-dong-ji-he.htmlhttps://web.archive.org/web/20220425041152/https://asp-cms.sourceforge.net/https://www.ddpoc.com/DVB-2021-821.htmlhttps://www.vulncheck.com/advisories/asp-cms-sql-injection-via-commentlist-asp-id-parameter