SQL Injection in Activewebsoftwares Active Bids
CVE-2009-0429
Multiple SQL injection vulnerabilities in Active Bids allow remote attackers to execute arbitrary SQL commands via the (1) search parameter to search.asp, (2) SortDir parameter to auctionsended.asp, and the (3) catid parameter to wishlist.php.
Vulnerability class: SQL Injection
EPSS: 0.009 (56.3th percentile) — read the EPSS interpretation.
Affected products
- Activewebsoftwares Active_bids
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)
- cve@mitre.org (Exploit, vdb-entry, x_refsource_BID)