SQL Injection Vulnerabilities in ActiveBuyAndSell by J. D. Software
CVE-2005-2062

Currently unrated

Key Information:

Vendor

Active Web Softwares

Status
Activebuyandsell
Vendor
CVE Published:
29 June 2005

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2005-2062?

ActiveBuyAndSell version 6.2 is vulnerable to multiple SQL injection attacks. Attackers can exploit this vulnerability through various parameters, including catid in default.asp and buyersend.asp, as well as in fields such as Administrator ID in admin.asp, Email in advertiserstart.asp and buyer.asp, and Keyword in search.asp. This can lead to the execution of arbitrary SQL commands, compromising database integrity and exposing sensitive information.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2005-2062 - Proof of Concept

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/33183
vdb-entryx_refsource_XF
http://www.vupen.com/english/advisories/2007/1096
vdb-entryx_refsource_VUPEN
https://www.exploit-db.com/exploits/3550
exploitx_refsource_EXPLOIT-DB

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.