Overview
- Description
- Multiple SQL injection vulnerabilities in Abarcar Realty Portal allow remote attackers to execute arbitrary SQL commands via the (1) neid parameter to newsdetails.php, or the (2) slid parameter to slistl.php. NOTE: the cat vector is already covered by CVE-2006-2853. NOTE: the vendor has notified CVE that the current version only creates static pages, and that slistl.php/slid never existed in any version
- Source
- cve@mitre.org
- NVD status
- Modified
- CNA Tags
- disputed
Risk scores
CVSS 2.0
- Type
- Primary
- Base score
- 7.5
- Impact score
- 6.4
- Exploitability score
- 10
- Vector string
- AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
- nvd@nist.gov
- CWE-89
Social media
- Hype score
- Not currently trending
Vendor comments
- abarcar SoftwareThe version 5.1.5 of the abarcar Realty Portal has been discontinued 2003. The version 6.xx has been discontinued beginning 2006. A fix for above versions has been available since that time. As of version 7.0 static pages are created - a parameter for cat.php is no longer used - the routine for news has been dropped and a different routine creating static pages is used - slistl.php never existed in the Realty Portal
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:abarcar:abarcar_realty_portal:5.1.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DE14B3E1-74AA-4E49-A010-B988564A113B"
},
{
"criteria": "cpe:2.3:a:abarcar:abarcar_realty_portal:6.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F11DEC59-C6B9-443D-B907-8ED9B03D3D41"
}
],
"operator": "OR"
}
]
}
]