high7.5Public exploit code
CVE-2010-1327
Multiple SQL injection vulnerabilities in TornadoStore 1.4.3 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the marca parameter t…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- TornadoStore 1.4.3 - SQL Injection / HTML Injection2010-06-29 · webapps · php · Verified
Impact
Multiple SQL injection vulnerabilities in TornadoStore 1.4.3 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the marca parameter to precios.php3 or (2) the where parameter in a delivery_courier action to control/abm_list.php3.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Tornadostore | Tornadostore | through 1.4.3 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.bonsai-sec.com/en/research/vulnerabilities/tornadostore-multiple-sql-injection-0106.php
- http://www.securityfocus.com/bid/41233
- https://exchange.xforce.ibmcloud.com/vulnerabilities/59950
- http://www.bonsai-sec.com/en/research/vulnerabilities/tornadostore-multiple-sql-injection-0106.php
- http://www.securityfocus.com/bid/41233
- https://exchange.xforce.ibmcloud.com/vulnerabilities/59950