CVE-2010-1706

Multiple SQL injection vulnerabilities in login.php in 2daybiz Auction Script allow remote attackers to execute arbitrary SQL commands via (1) the login field (aka the username parameter), and possibly (2) the password field, to index.php. NOTE: some of these details are obtained from third party information.

CVSS v2.0

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

1.19% chance of exploitation in the next 30 days, 66th percentile

Published

2010-05-04

Updated

2024-08-07

Proof-of-concept exploits (1)

• http://www.exploit-db.com/exploits/12414

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/12414

References

• CVE Record
• NVD entry

Related

• CVE-2010-1705
• CVE-2010-1708
• CVE-2010-1704
• CVE-2010-1710
• CVE-2010-1703
• CVE-2010-1711