ID CVE-2007-4084
Summary Multiple SQL injection vulnerabilities in AlstraSoft Affiliate Network Pro allow remote attackers to execute arbitrary SQL commands via (1) the pgmid parameter in an uploadProducts action to merchants/index.php and possibly (2) the rowid parameter to merchants/temp.php.
References
Vulnerable Configurations
  • cpe:2.3:a:alstrasoft:affiliate_network_pro:8.0:*:*:*:*:*:*:*
    cpe:2.3:a:alstrasoft:affiliate_network_pro:8.0:*:*:*:*:*:*:*
CVSS
Base: 7.5 (as of 15-11-2008 - 06:55)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:P/A:P
refmap via4
bid 25026
misc http://lostmon.blogspot.com/2007/07/alstrasoft-multiple-products-multiple.html
osvdb
  • 37869
  • 37870
Last major update 15-11-2008 - 06:55
Published 30-07-2007 - 17:30
Back to Top