medium6.4Public exploit code
CVE-2004-0374
Interchange before 5.0.1 allows remote attackers to "expose the content of arbitrary variables" and read or modify sensitive SQL information via an HTTP reques…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Interchange 4.8.x/5.0 - Remote Information Disclosure2004-03-30 · webapps · asp · Verified
Impact
Interchange before 5.0.1 allows remote attackers to "expose the content of arbitrary variables" and read or modify sensitive SQL information via an HTTP request ending with the "__SQLUSER__" string.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Interchange Development Group | Interchange | Versions 4.8.1, 4.8.2, 4.8.3, 4.8.4, 4.8.5, 4.8.6 |
References
- NVD record
- CVE.org record
- http://ftp.icdevgroup.org/interchange/5.0/WHATSNEW
- http://secunia.com/advisories/11234
- http://www.debian.org/security/2004/dsa-471
- http://www.icdevgroup.org/pipermail/interchange-announce/2004/000043.html
- http://www.securityfocus.com/bid/10005
- https://exchange.xforce.ibmcloud.com/vulnerabilities/15670
- http://ftp.icdevgroup.org/interchange/5.0/WHATSNEW
- http://secunia.com/advisories/11234
- http://www.debian.org/security/2004/dsa-471
- http://www.icdevgroup.org/pipermail/interchange-announce/2004/000043.html
- http://www.securityfocus.com/bid/10005
- https://exchange.xforce.ibmcloud.com/vulnerabilities/15670