7.5high
CVE-2004-27461 exploit
SQL injection vulnerability in adminlogin.asp in XTREME ASP Photo Gallery 2.0 allows remote attackers to execute arbitrary SQL commands via…
Published 21 y ago · modified 4 mo ago · JSON
CVSS
7.5
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
3.0%
percentile 87%
Public exploits
1
Exploit-DB
Summary
SQL injection vulnerability in adminlogin.asp in XTREME ASP Photo Gallery 2.0 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.
Exploit prediction (EPSS)
2.96% probability of exploitation in the next 30 days, higher than 87% of all scored CVEs.
Exploits and detections
- EDB-23547 XtremeASP PhotoGallery 2.0 - 'Adminlogin.asp' SQL Injection · webapps · 2004-01-16
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Classification
- Weakness
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command
References
- securityfocus.com /archive/1/350028/30/21640/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
- securityfocus.com /bid/9438 · vdb-entry, x_refsource_BID, x_transferred
- securitytracker.com /id?1008745 · vdb-entry, x_refsource_SECTRACK, x_transferred
- exchange.xforce.ibmcloud.com /vulnerabilities/14860 · vdb-entry, x_refsource_XF, x_transferred
- pensacolawebdesigns.com /xtremeasp/readmore.asp · x_refsource_CONFIRM, x_transferred
- osvdb.org /3585 · vdb-entry, x_refsource_OSVDB, x_transferred
- securityreason.com /securityalert/3346 · third-party-advisory, x_refsource_SREASON, x_transferred
- tripbit.org /advisories/TA-150104.txt · x_refsource_MISC, x_transferred
- secunia.com /advisories/10659 · third-party-advisory, x_refsource_SECUNIA, x_transferred
Sources
- CVE List: CVE-2004-2746
- NVD: CVE-2004-2746
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.