VulnerabilityModified
CVE-2008-5974
Multiple SQL injection vulnerabilities in login.aspx in Active Price Comparison 4.0 allow remote attackers to execute arbitrary SQL commands via the (1) password and (2) username fields.
HIGH 7.5EPSS 1.02%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.02%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Multiple SQL injection vulnerabilities in login.aspx in Active Price Comparison 4.0 allow remote attackers to execute arbitrary SQL commands via the (1) password and (2) username fields.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 1.02% probability · 61th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-89
- Affected
- activewebsoftwares/active price comparison
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/32921Vendor Advisory
- http://www.vupen.com/english/advisories/2008/3296
- https://exchange.xforce.ibmcloud.com/vulnerabilities/46909
- https://www.exploit-db.com/exploits/7283
- http://secunia.com/advisories/32921Vendor Advisory
- http://www.vupen.com/english/advisories/2008/3296
- https://exchange.xforce.ibmcloud.com/vulnerabilities/46909
- https://www.exploit-db.com/exploits/7283
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.