vulnwire
7.5high

CVE-2005-42436 exploits

Multiple SQL injection vulnerabilities in QuickPayPro 3.1 allow remote attackers to execute arbitrary SQL commands via the (1) popupid para…

Published 20 y ago · modified 4 mo ago · JSON

CVSS
7.5
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
4.7%
percentile 92%
Public exploits
6
Exploit-DB

Multiple SQL injection vulnerabilities in QuickPayPro 3.1 allow remote attackers to execute arbitrary SQL commands via the (1) popupid parameter in popups.edit.php; (2) so, (3) sb, and (4) nr parameters in customer.tickets.view.php; (5) subrackingid parameter in subscribers.tracking.edit.php; (6) delete parameter in design.php; (7) trackingid parameter in tracking.details.php; and (8) customerid parameter in sales.view.php.

Exploit prediction (EPSS)

4.65% probability of exploitation in the next 30 days, higher than 92% of all scored CVEs.

Exploits and detections

  • EDB-26832 QuickPayPro 3.1 - 'sales.view.php?customerid' SQL Injection · webapps · 2005-12-14
  • EDB-26831 QuickPayPro 3.1 - 'tracking.details.php?trackingid' SQL Injection · webapps · 2005-12-14
  • EDB-26830 QuickPayPro 3.1 - 'design.php?delete' SQL Injection · webapps · 2005-12-14
  • EDB-26829 QuickPayPro 3.1 - 'subscribers.tracking.edit.php?subtrackingid' SQL Injection · webapps · 2005-12-14
  • EDB-26828 QuickPayPro 3.1 - 'customer.tickets.view.php' Multiple SQL Injections · webapps · 2005-12-14
  • EDB-26827 QuickPayPro 3.1 - 'popups.edit.php?popupid' SQL Injection · webapps · 2005-12-14

CVSS scores

Assigned byVersionScoreVector
NVD2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P

References

  • pridels0.blogspot.com /2005/12/quickpaypro-31-multiple-vuln.html · x_refsource_MISC, x_transferred
  • vupen.com /english/advisories/2005/2875 · vdb-entry, x_refsource_VUPEN, x_transferred
  • osvdb.org /21676 · vdb-entry, x_refsource_OSVDB, x_transferred
  • osvdb.org /21681 · vdb-entry, x_refsource_OSVDB, x_transferred
  • secunia.com /advisories/17981 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • osvdb.org /21679 · vdb-entry, x_refsource_OSVDB, x_transferred
  • securityfocus.com /bid/15863 · vdb-entry, x_refsource_BID, x_transferred
  • osvdb.org /21677 · vdb-entry, x_refsource_OSVDB, x_transferred
  • osvdb.org /21680 · vdb-entry, x_refsource_OSVDB, x_transferred
  • osvdb.org /21678 · vdb-entry, x_refsource_OSVDB, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.