CVE-2004-0300

SQL injection vulnerability in Online Store Kit 3.0 allows remote attackers to inject arbitrary SQL and gain unauthorized access via (1) the cat parameter in shop.php, (2) the id parameter in more.php, (3) the cat_manufacturer parameter in shop_by_brand.php, or (4) the id parameter in listing.php.

CVSS v2.0

10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

5.17% chance of exploitation in the next 30 days, 92th percentile

Published

2004-03-18

Updated

2024-08-08

ExploitDB entries (4)

• https://www.exploit-db.com/exploits/23720
• https://www.exploit-db.com/exploits/23719
• https://www.exploit-db.com/exploits/23718
• https://www.exploit-db.com/exploits/23711

References

• CVE Record
• NVD entry

Related

• CVE-2004-0299
• CVE-2004-0301
• CVE-2004-0298
• CVE-2004-0302
• CVE-2004-0297
• CVE-2004-0303