6.8med
CVE-2005-32082 exploits
Multiple SQL injection vulnerabilities in (1) aeNovo, (2) aeNovoShop and (3) aeNovoWYSI allow remote attackers to execute arbitrary SQL cod…
Published 21 y ago · modified 4 mo ago · JSON
CVSS
6.8
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
2.2%
percentile 82%
Public exploits
2
Exploit-DB
Summary
Multiple SQL injection vulnerabilities in (1) aeNovo, (2) aeNovoShop and (3) aeNovoWYSI allow remote attackers to execute arbitrary SQL code via (a) the password parameter in control.asp, and (b) the strSQL parameter in search.asp, which can enable XSS attacks in resulting error messages.
Exploit prediction (EPSS)
2.15% probability of exploitation in the next 30 days, higher than 82% of all scored CVEs.
Exploits and detections
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
References
- secunia.com /advisories/17117/ · third-party-advisory, x_refsource_SECUNIA, x_transferred
- osvdb.org /19936 · vdb-entry, x_refsource_OSVDB, x_transferred
- securityfocus.com /bid/15036 · vdb-entry, x_refsource_BID, x_transferred
- marc.info /?l=bugtraq&m=112872593432359&w=2 · mailing-list, x_refsource_BUGTRAQ, x_transferred
- exchange.xforce.ibmcloud.com /vulnerabilities/22553 · vdb-entry, x_refsource_XF, x_transferred
- exchange.xforce.ibmcloud.com /vulnerabilities/22551 · vdb-entry, x_refsource_XF, x_transferred
- kapda.ir /advisory-78.html · x_refsource_MISC, x_transferred
- securityfocus.com /bid/15038 · vdb-entry, x_refsource_BID, x_transferred
- exchange.xforce.ibmcloud.com /vulnerabilities/22547 · vdb-entry, x_refsource_XF, x_transferred
- osvdb.org /19937 · vdb-entry, x_refsource_OSVDB, x_transferred
Sources
- CVE List: CVE-2005-3208
- NVD: CVE-2005-3208
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.