Unscored severity · published Apr 2, 2003
CVE-2002-1499
Multiple SQL injection vulnerabilities in FactoSystem CMS allows remote attackers to perform unauthorized database actions via (1) the authornumber parameter in author.asp, (2)…
–
CVSS
2.5%
EPSS
No
On KEV
Description
Multiple SQL injection vulnerabilities in FactoSystem CMS allows remote attackers to perform unauthorized database actions via (1) the authornumber parameter in author.asp, (2) the discussblurbid parameter in discuss.asp, (3) the name parameter in holdcomment.asp, and (4) the email parameter in holdcomment.asp.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.5% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FW
Factosystem Weblog · Factosystem
0.9b; 1.0_beta; 1.1_beta · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2002-1499
CVE.org
https://www.cve.org/CVERecord?id=CVE-2002-1499
archives.neohapsis.com
http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0097.html
Exploit
http://online.securityfocus.com/archive/1/290021
sourceforge.net
http://sourceforge.net/tracker/index.php?func=detail&aid=602711&group_id=12668&atid=112668
Vendor Advisory
http://www.iss.net/security_center/static/10000.php
Exploit
http://www.securityfocus.com/bid/5600
More from Factosystem Weblog
–
CVE-2008-5935
Facto stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file containing the password via a…