medium6.8Public exploit code
CVE-2007-4085
Multiple SQL injection vulnerabilities in AlstraSoft AskMe Pro allow remote attackers to execute arbitrary SQL commands via the (1) que_id parameter to forum_a…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Alstrasoft AskMe Pro 2.1 - 'que_id' SQL Injection2010-04-24 · webapps · php · Verified
Impact
Multiple SQL injection vulnerabilities in AlstraSoft AskMe Pro allow remote attackers to execute arbitrary SQL commands via the (1) que_id parameter to forum_answer.php or (2) the cat_id parameter to search.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Alstrasoft | Askme Pro | All versions |
References
- NVD record
- CVE.org record
- http://lostmon.blogspot.com/2007/07/alstrasoft-multiple-products-multiple.html
- http://osvdb.org/37095
- http://osvdb.org/37096
- http://osvdb.org/46166
- http://lostmon.blogspot.com/2007/07/alstrasoft-multiple-products-multiple.html
- http://osvdb.org/37095
- http://osvdb.org/37096
- http://osvdb.org/46166