vulnwire
7.5high

CVE-2005-40353 exploits

Multiple SQL injection vulnerabilities in Web4Future eCommerce Enterprise Edition 2.1 and earlier allow remote attackers to execute arbitra…

Published 20 y ago · modified 4 mo ago · JSON

CVSS
7.5
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.3%
percentile 71%
Public exploits
3
Exploit-DB

Multiple SQL injection vulnerabilities in Web4Future eCommerce Enterprise Edition 2.1 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) prod, and (2) brid parameters to (a) view.php; the (3) the bid parameter to (b) viewbrands.php; and the (4) grp and (5) cat parameters to index.php.

Exploit prediction (EPSS)

1.33% probability of exploitation in the next 30 days, higher than 71% of all scored CVEs.

Exploits and detections

  • EDB-26719 Web4Future eCommerce Enterprise Edition 2.1 - 'viewbrands.php?bid' SQL Injection · webapps · 2005-12-05
  • EDB-26718 Web4Future eCommerce Enterprise Edition 2.1 - 'index.php' Multiple SQL Injections · webapps · 2005-12-05
  • EDB-26717 Web4Future eCommerce Enterprise Edition 2.1 - 'view.php' Multiple SQL Injections · webapps · 2005-12-05

CVSS scores

Assigned byVersionScoreVector
NVD2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P

References

  • osvdb.org /21468 · vdb-entry, x_refsource_OSVDB, x_transferred
  • secunia.com /advisories/17881 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • vupen.com /english/advisories/2005/2744 · vdb-entry, x_refsource_VUPEN, x_transferred
  • pridels0.blogspot.com /2005/12/ecommerce-enterprise-edition-sql-inj.html · x_refsource_MISC, x_transferred
  • osvdb.org /21467 · vdb-entry, x_refsource_OSVDB, x_transferred
  • securityfocus.com /bid/15707 · vdb-entry, x_refsource_BID, x_transferred
  • osvdb.org /21466 · vdb-entry, x_refsource_OSVDB, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.