CVE-2005-4035

Web4Future eCommerce Enterprise Edition <2.1 - SQL Injection

Title source: llm

Description

Multiple SQL injection vulnerabilities in Web4Future eCommerce Enterprise Edition 2.1 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) prod, and (2) brid parameters to (a) view.php; the (3) the bid parameter to (b) viewbrands.php; and the (4) grp and (5) cat parameters to index.php.

Exploits (3)

exploitdb WRITEUP VERIFIED

by r0t3d3Vil · textwebappsphp

https://www.exploit-db.com/exploits/26719

View Code ZIP pw:eip

exploitdb WRITEUP VERIFIED

by r0t3d3Vil · textwebappsphp

https://www.exploit-db.com/exploits/26718

View Code ZIP pw:eip

exploitdb WRITEUP VERIFIED

by r0t3d3Vil · textwebappsphp

https://www.exploit-db.com/exploits/26717

View Code ZIP pw:eip

References (7)

[Third Party Advisory] http://pridels0.blogspot.com/2005/12/ecommerce-enterprise-edition-sql-inj.html

[Exploit] http://www.securityfocus.com/bid/15707

[Third Party Advisory, VDB Entry] http://www.osvdb.org/21466

[Third Party Advisory, VDB Entry] http://www.osvdb.org/21467

[Third Party Advisory, VDB Entry] http://www.osvdb.org/21468

[Third Party Advisory] http://secunia.com/advisories/17881

[Third Party Advisory] http://www.vupen.com/english/advisories/2005/2744

Scores

EPSS 0.0076

EPSS Percentile 73.1%

Classification

Status draft

Timeline

Published Dec 06, 2005

Tracked Since Feb 18, 2026