Vulnerability CVE-2008-7049
Published: 2009-08-24   Modified: 2012-02-12

Description:
Multiple SQL injection vulnerabilities in login.asp in NatterChat 1.1 and 1.12 allow remote attackers to execute arbitrary SQL commands via the (1) txtUsername parameter (aka Username) and (2) txtPassword parameter (aka Password) in a form generated by home.asp. NOTE: due to lack of details, it is not clear whether this is related to CVE-2004-2206.

See advisories in our WLB2 database:
Topic
Author
Date
High
NatterChat 1.1 (Auth Bypass) Remote SQL Injection Vulnerability
Bl@ckbe@rD
27.08.2009

Type:

CWE-89

 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
7.5/10
6.4/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
Natterchat -> Natterchat 

 References:
http://www.milw0rm.com/exploits/7172
http://www.milw0rm.com/exploits/7175
http://www.securityfocus.com/bid/32385
https://exchange.xforce.ibmcloud.com/vulnerabilities/46748
Copyright 2024, cxsecurity.com

 

Back to Top