Unscored severity · published Jun 22, 2005
CVE-2005-1250
SQL injection vulnerability in the logon screen of the web front end (NmConsole/Login.asp) for IpSwitch WhatsUp Professional 2005 SP1 allows remote attackers to execute arbitrary…
–
CVSS
20.9%
EPSS
No
On KEV
Description
SQL injection vulnerability in the logon screen of the web front end (NmConsole/Login.asp) for IpSwitch WhatsUp Professional 2005 SP1 allows remote attackers to execute arbitrary SQL commands via the (1) User Name field (sUserName parameter) or (2) Password (sPassword parameter).
Exploitation
Is it being used?
Exploit prediction (EPSS)20.9% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WH
Whatsup · Ipswitch
professional_2005_sp1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2005-1250
CVE.org
https://www.cve.org/CVERecord?id=CVE-2005-1250
secunia.com
http://secunia.com/secunia_research/2005-13/advisory/
www.corsaire.com
http://www.corsaire.com/advisories/c050323-001.txt
Patch
http://www.idefense.com/application/poi/display?id=268&type=vulnerabilities
Patch
http://www.ipswitch.com/forums/shwmessage.aspx?ForumID=20&MessageID=7699
More from Whatsup
–
CVE-2006-2531
Ipswitch WhatsUp Professional 2006 only verifies the user's identity via HTTP headers, which allows remote attackers to spoof being a trusted console and bypass authentication by…
–
CVE-2006-0911
NmService.exe in Ipswitch WhatsUp Professional 2006 allows remote attackers to cause a denial of service (CPU consumption) via crafted requests to Login.asp, possibly involving…