Unscored severity · published May 2, 2005
CVE-2005-0302
SQL injection vulnerability in default.asp in BackOffice Lite 6.0 and 6.01 allows remote attackers to execute arbitrary SQL commands via the referer field in the HTTP header
–
CVSS
1.3%
EPSS
No
On KEV
Description
SQL injection vulnerability in default.asp in BackOffice Lite 6.0 and 6.01 allows remote attackers to execute arbitrary SQL commands via the referer field in the HTTP header.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CB
Comersus Backoffice Lite · Comersus Open Technologies
6.0; 6.1 · source: NVD
Affected product
CB
Comersus Backoffice Lite
Comersus Open Technologies
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2005-0302
CVE.org
https://www.cve.org/CVERecord?id=CVE-2005-0302
marc.info
http://marc.info/?l=bugtraq&m=110636597832556&w=2
Exploit
http://www.securiteam.com/windowsntfocus/5TP0Q0UEKI.html
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/19013
More from Comersus Backoffice Lite
–
CVE-2005-3397
Cross-site scripting (XSS) vulnerability in Comersus BackOffice allows remote attackers to inject arbitrary web script or HTML via the error parameter to…
–
CVE-2005-0301
comersus_backoffice_install10.asp in BackOffice Lite 6.0 and 6.01 allows remote attackers to bypass authentication and gain privileges via a direct request to the program
–
CVE-2005-0303
Multiple cross-site scripting (XSS) vulnerabilities in (1) comersus_supportError.asp or (2) comersus_backofficelite_supportError.asp in BackOffice Lite 6.0 and 6.01 allow remote…