Vulnerabilities > CVE-2005-4243 - Input Validation vulnerability in Quickpaypro 3.1

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
quickpaypro
exploit available
NVD
Published: 2005-12-15
Updated: 2011-03-08

Summary

Multiple SQL injection vulnerabilities in QuickPayPro 3.1 allow remote attackers to execute arbitrary SQL commands via the (1) popupid parameter in popups.edit.php; (2) so, (3) sb, and (4) nr parameters in customer.tickets.view.php; (5) subrackingid parameter in subscribers.tracking.edit.php; (6) delete parameter in design.php; (7) trackingid parameter in tracking.details.php; and (8) customerid parameter in sales.view.php.

Vulnerable Configurations

Part Description Count
Application
Quickpaypro
1

Exploit-Db

  • descriptionQuickPayPro 3.1 customer.tickets.view.php Multiple Parameter SQL Injection. CVE-2005-4243 . Webapps exploit for php platform
    idEDB-ID:26828
    last seen2016-02-03
    modified2005-12-14
    published2005-12-14
    reporterr0t
    sourcehttps://www.exploit-db.com/download/26828/
    titleQuickPayPro 3.1 customer.tickets.view.php Multiple Parameter SQL Injection
  • descriptionQuickPayPro 3.1 subscribers.tracking.edit.php subtrackingid Parameter SQL Injection. CVE-2005-4243. Webapps exploit for php platform
    idEDB-ID:26829
    last seen2016-02-03
    modified2005-12-14
    published2005-12-14
    reporterr0t
    sourcehttps://www.exploit-db.com/download/26829/
    titleQuickPayPro 3.1 subscribers.tracking.edit.php subtrackingid Parameter SQL Injection
  • descriptionQuickPayPro 3.1 popups.edit.php popupid Parameter SQL Injection. CVE-2005-4243 . Webapps exploit for php platform
    idEDB-ID:26827
    last seen2016-02-03
    modified2005-12-14
    published2005-12-14
    reporterr0t
    sourcehttps://www.exploit-db.com/download/26827/
    titleQuickPayPro 3.1 popups.edit.php popupid Parameter SQL Injection
  • descriptionQuickPayPro 3.1 design.php delete Parameter SQL Injection. CVE-2005-4243. Webapps exploit for php platform
    idEDB-ID:26830
    last seen2016-02-03
    modified2005-12-14
    published2005-12-14
    reporterr0t
    sourcehttps://www.exploit-db.com/download/26830/
    titleQuickPayPro 3.1 design.php delete Parameter SQL Injection
  • descriptionQuickPayPro 3.1 tracking.details.php trackingid Parameter SQL Injection. CVE-2005-4243. Webapps exploit for php platform
    idEDB-ID:26831
    last seen2016-02-03
    modified2005-12-14
    published2005-12-14
    reporterr0t
    sourcehttps://www.exploit-db.com/download/26831/
    titleQuickPayPro 3.1 tracking.details.php trackingid Parameter SQL Injection
  • descriptionQuickPayPro 3.1 sales.view.php customerid Parameter SQL Injection. CVE-2005-4243. Webapps exploit for php platform
    idEDB-ID:26832
    last seen2016-02-03
    modified2005-12-14
    published2005-12-14
    reporterr0t
    sourcehttps://www.exploit-db.com/download/26832/
    titleQuickPayPro 3.1 sales.view.php customerid Parameter SQL Injection

References