high7.5Public exploit code
CVE-2013-7193
Multiple SQL injection vulnerabilities in C2C Forward Auction Creator 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) pa parameter to …
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- C2C Forward Auction Creator - '/auction/casp/Admin.asp' SQL Injection (Admin Authentication Bypass)2013-12-16 · webapps · php · Verified
- C2C Forward Auction Creator 2.0 - '/auction/asp/list.asp?pa' SQL Injection2013-12-16 · webapps · php · Verified
Impact
Multiple SQL injection vulnerabilities in C2C Forward Auction Creator 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) pa parameter to auction/asp/list.asp, or the (2) UserID or (3) Password to auction/casp/admin.asp.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Etoshop | C2c Forward Auction Creator | Version 2.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://osvdb.org/101075
- http://osvdb.org/101076
- http://packetstormsecurity.com/files/124441/c2cfac-sql.txt
- http://www.securityfocus.com/bid/64329
- https://exchange.xforce.ibmcloud.com/vulnerabilities/89752
- https://exchange.xforce.ibmcloud.com/vulnerabilities/89755
- http://osvdb.org/101075
- http://osvdb.org/101076
- http://packetstormsecurity.com/files/124441/c2cfac-sql.txt
- http://www.securityfocus.com/bid/64329
- https://exchange.xforce.ibmcloud.com/vulnerabilities/89752
- https://exchange.xforce.ibmcloud.com/vulnerabilities/89755