CVE-2004-1553
aspWebAlbum - SQL Injection via Username Field or Cat Parameter
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2004-1553. PoCs published by e.wiZz!, Alemin_Krali.
AI-analyzed exploit summary The exploit demonstrates multiple vulnerabilities in aspWebAlbum 3.2, including arbitrary file upload, admin bypass via SQL injection, and XSS. It provides clear URLs and parameters for exploitation.
Description
SQL injection vulnerability in aspWebAlbum allows remote attackers to execute arbitrary SQL statements via (1) the username field on the login page or (2) the cat parameter to album.asp. NOTE: it was later reported that vector 1 affects aspWebAlbum 3.2, and the vector involves the txtUserName parameter in a processlogin action to album.asp, as reachable from the login action.
Exploits (2)
The exploit demonstrates multiple vulnerabilities in aspWebAlbum 3.2, including arbitrary file upload, admin bypass via SQL injection, and XSS. It provides clear URLs and parameters for exploitation.
This is a writeup detailing multiple vulnerabilities in aspWebAlbum 3.2, including arbitrary file upload, admin bypass, and XSS. It provides URLs and parameters for exploitation but does not include functional exploit code.