Description
SQL injection vulnerability in aspWebAlbum allows remote attackers to execute arbitrary SQL statements via (1) the username field on the login page or (2) the cat parameter to album.asp. NOTE: it was later reported that vector 1 affects aspWebAlbum 3.2, and the vector involves the txtUserName parameter in a processlogin action to album.asp, as reachable from the login action.
Exploits (2)
exploitdb
WRITEUP
VERIFIED
by Alemin_Krali · textwebappsphp
https://www.exploit-db.com/exploits/6357
References (11)
Core 11
Core References
Exploit vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/11246
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/31649
Exploit vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/30996
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/44877
Mailing List mailing-list
x_refsource_bugtraq
http://marc.info/?l=bugtraq&m=109604910025090&w=2
Exploit, Third Party Advisory exploit
x_refsource_exploit-db
https://www.exploit-db.com/exploits/6420
Exploit, Third Party Advisory exploit
x_refsource_exploit-db
https://www.exploit-db.com/exploits/6357
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://osvdb.org/47913
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://osvdb.org/47914
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/44876
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/17507
Scores
EPSS
0.0406
EPSS Percentile
88.6%
Details
CWE
CWE-89
Status
published
Products (1)
fullrevolution/aspwebalbum
3.2
Published
Dec 31, 2004
Tracked Since
Feb 18, 2026