CVEブラウザに戻る

CVE-2007-4121

CRITICAL

10.0

CVSS Severity Score

EPSS Score0.1340%

EPSS Percentile24.12th

Published2007年8月1日

Last Modified2026年4月23日

Vulnerability Description

Multiple SQL injection vulnerabilities in admin.aspx in E-Commerce Scripts Shopping Cart Script, Multi-Vendor E-Shop Script, and Auction Script allow remote attackers to execute arbitrary SQL commands via the (1) EmailAdd (Username) and (2) Pass (password) parameters. NOTE: some of these details are obtained from third party information.

Affected Platforms (CPE)

📦

E Commerce Solutions

Auction Script

All versions

📦

E Commerce Solutions

Multi Vendor E Shop Script

All versions

📦

E Commerce Solutions

Shopping Cart Script

All versions

References & Advisories

🔗 http://outlaw.aria-security.info/?p=11

🔗 http://secunia.com/advisories/26277

🔗 http://securityreason.com/securityalert/2944

🔗 http://www.securityfocus.com/archive/1/475062/100/0/threaded

🔗 http://www.securityfocus.com/bid/25125

🔗 https://exchange.xforce.ibmcloud.com/vulnerabilities/35680

🔗 http://outlaw.aria-security.info/?p=11

🔗 http://secunia.com/advisories/26277

関連する脆弱性情報

CVE-2000-069010.0

Auction Weaver CGI script 1.02 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the f...

CVE-2000-068710.0

Auction Weaver CGI script 1.03 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) attack in the catdir...

CVE-2017-176219.8

Multivendor Penny Auction Clone Script 1.0 has SQL Injection via the PATH_INFO to the /detail URI.

CVE-2002-02577.5

Cross-site scripting vulnerability in auction.pl of MakeBid Auction Deluxe 3.30 allows remote attackers to obtain information from...