Description
Multiple SQL injection vulnerabilities in login.asp in NatterChat 1.1 and 1.12 allow remote attackers to execute arbitrary SQL commands via the (1) txtUsername parameter (aka Username) and (2) txtPassword parameter (aka Password) in a form generated by home.asp. NOTE: due to lack of details, it is not clear whether this is related to CVE-2004-2206.
Exploits (2)
exploitdb
WORKING POC
VERIFIED
by Bl@ckbe@rD · textwebappsphp
https://www.exploit-db.com/exploits/7172
References (4)
Core 4
Core References
Exploit vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/32385
Exploit, Third Party Advisory exploit
x_refsource_exploit-db
https://www.exploit-db.com/exploits/7175
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/46748
Exploit, Third Party Advisory exploit
x_refsource_exploit-db
https://www.exploit-db.com/exploits/7172
Scores
EPSS
0.0038
EPSS Percentile
59.5%
Details
CWE
CWE-89
Status
published
Products (2)
natterchat/natterchat
1.1
natterchat/natterchat
1.12
Published
Aug 24, 2009
Tracked Since
Feb 18, 2026