CVE-2004-2746

23Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 3.0%

from disclosure to weapon0 days

Published on NVDNov 8

1st PoCJan 16

exploitation probability

3.0%top 14% of all CVEs

observed exploitation

nono source reports it

1 public exploit(s)

SQL injection vulnerability in adminlogin.asp in XTREME ASP Photo Gallery 2.0 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.

Affected products

n/a · n/a

public PoCs found — 1✓ VexDay Proof

exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/23547

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://secunia.com/advisories/10659 http://securityreason.com/securityalert/3346 http://securitytracker.com/id?1008745 https://exchange.xforce.ibmcloud.com/vulnerabilities/14860 http://www.osvdb.org/3585 http://www.pensacolawebdesigns.com/xtremeasp/readmore.asp http://www.securityfocus.com/archive/1/350028/30/21640/threaded http://www.securityfocus.com/bid/9438 http://www.tripbit.org/advisories/TA-150104.txt