Vulnerabilities > CVE-2005-4486 - Unspecified vulnerability in Quantum ART QP7 Enterprise
Attack vector
UNKNOWN Attack complexity
UNKNOWN Privileges required
UNKNOWN Confidentiality impact
UNKNOWN Integrity impact
UNKNOWN Availability impact
UNKNOWN quantum-art
exploit available
Summary
SQL injection vulnerability in Quantum Art QP7.Enterprise (formerly Q-Publishing) allows remote attackers to execute arbitrary SQL commands via the p_news_id parameter to (1) news_and_events_new.asp and (2) news.asp. NOTE: on 20060227, the vendor disputed the accuracy of this report, saying that the p_news_id, news_and_events_new.asp, and news.asp are not specifically part of their product, although they could be dynamically generated through use of the product. Some investigation by CVE suggests evidence that the news_and_events_new.asp page has at least a forced invalid SQL syntax error, but this could not be repeated for news.asp
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 1 |
Exploit-Db
description Quantum Art QP7.Enterprise news.asp p_news_id Parameter SQL Injection. CVE-2005-4486. Webapps exploit for asp platform id EDB-ID:26964 last seen 2016-02-03 modified 2005-12-21 published 2005-12-21 reporter r0t3d3Vil source https://www.exploit-db.com/download/26964/ title Quantum Art QP7.Enterprise news.asp p_news_id Parameter SQL Injection description Quantum Art QP7.Enterprise news_and_events_new.asp p_news_id Parameter SQL Injection. CVE-2005-4486. Webapps exploit for asp platform id EDB-ID:26963 last seen 2016-02-03 modified 2005-12-21 published 2005-12-21 reporter r0t3d3Vil source https://www.exploit-db.com/download/26963/ title Quantum Art QP7.Enterprise news_and_events_new.asp p_news_id Parameter SQL Injection