Search criteria

16 vulnerabilities found for affiliate_network_pro by alstrasoft

CVE-2008-3240 (GCVE-0-2008-3240)

Vulnerability from nvd – Published: 2008-07-21 16:00 – Updated: 2024-08-07 09:28
VLAI?
Summary
SQL injection vulnerability in index.php in AlstraSoft Affiliate Network Pro allows remote attackers to execute arbitrary SQL commands via the pgm parameter in a directory action.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://securityreason.com/securityalert/4016 third-party-advisoryx_refsource_SREASON
http://www.securityfocus.com/bid/30259 vdb-entryx_refsource_BID
https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
https://www.exploit-db.com/exploits/6087 exploitx_refsource_EXPLOIT-DB
http://secunia.com/advisories/31112 third-party-advisoryx_refsource_SECUNIA
http://www.vupen.com/english/advisories/2008/2122… vdb-entryx_refsource_VUPEN
Date Public ?
2008-07-16 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T09:28:41.835Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "4016",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/4016"
          },
          {
            "name": "30259",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/30259"
          },
          {
            "name": "alstrasoft-pgm-sql-injection(43848)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43848"
          },
          {
            "name": "6087",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/6087"
          },
          {
            "name": "31112",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/31112"
          },
          {
            "name": "ADV-2008-2122",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2008/2122/references"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2008-07-16T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SQL injection vulnerability in index.php in AlstraSoft Affiliate Network Pro allows remote attackers to execute arbitrary SQL commands via the pgm parameter in a directory action."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-09-28T12:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "4016",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/4016"
        },
        {
          "name": "30259",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/30259"
        },
        {
          "name": "alstrasoft-pgm-sql-injection(43848)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43848"
        },
        {
          "name": "6087",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/6087"
        },
        {
          "name": "31112",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/31112"
        },
        {
          "name": "ADV-2008-2122",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2008/2122/references"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2008-3240",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "SQL injection vulnerability in index.php in AlstraSoft Affiliate Network Pro allows remote attackers to execute arbitrary SQL commands via the pgm parameter in a directory action."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "4016",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/4016"
            },
            {
              "name": "30259",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/30259"
            },
            {
              "name": "alstrasoft-pgm-sql-injection(43848)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43848"
            },
            {
              "name": "6087",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/6087"
            },
            {
              "name": "31112",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/31112"
            },
            {
              "name": "ADV-2008-2122",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2008/2122/references"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2008-3240",
    "datePublished": "2008-07-21T16:00:00.000Z",
    "dateReserved": "2008-07-21T00:00:00.000Z",
    "dateUpdated": "2024-08-07T09:28:41.835Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2007-5223 (GCVE-0-2007-5223)

Vulnerability from nvd – Published: 2007-10-05 00:00 – Updated: 2024-08-07 15:24
VLAI?
Summary
Multiple unspecified vulnerabilities in AlstraSoft Affiliate Network Pro allow remote attackers to include local files and have other unspecified impact, related to incorrect input validation or other defects involving (1) admin/backupstart.php, (2) a .sql filename under admin/admin/dump/, (3) a .sql filename in the fl parameter to admin/downloadbackup.php, and (4) a .. (dot dot) in the fl parameter to admin/downloadbackup.php.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://osvdb.org/42342 vdb-entryx_refsource_OSVDB
http://www.securityfocus.com/archive/1/481206/100… mailing-listx_refsource_BUGTRAQ
http://osvdb.org/42344 vdb-entryx_refsource_OSVDB
http://osvdb.org/42343 vdb-entryx_refsource_OSVDB
http://www.securityfocus.com/bid/25882 vdb-entryx_refsource_BID
http://securityreason.com/securityalert/3191 third-party-advisoryx_refsource_SREASON
http://www.vupen.com/english/advisories/2007/3344 vdb-entryx_refsource_VUPEN
Date Public ?
2007-09-29 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T15:24:42.336Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "42342",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/42342"
          },
          {
            "name": "20070929 Affiliate Network Pro Multiple Input Validation and Local file inclusion",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/481206/100/0/threaded"
          },
          {
            "name": "42344",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/42344"
          },
          {
            "name": "42343",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/42343"
          },
          {
            "name": "25882",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/25882"
          },
          {
            "name": "3191",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/3191"
          },
          {
            "name": "ADV-2007-3344",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2007/3344"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2007-09-29T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple unspecified vulnerabilities in AlstraSoft Affiliate Network Pro allow remote attackers to include local files and have other unspecified impact, related to incorrect input validation or other defects involving (1) admin/backupstart.php, (2) a .sql filename under admin/admin/dump/, (3) a .sql filename in the fl parameter to admin/downloadbackup.php, and (4) a .. (dot dot) in the fl parameter to admin/downloadbackup.php."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-15T20:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "42342",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/42342"
        },
        {
          "name": "20070929 Affiliate Network Pro Multiple Input Validation and Local file inclusion",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/481206/100/0/threaded"
        },
        {
          "name": "42344",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/42344"
        },
        {
          "name": "42343",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/42343"
        },
        {
          "name": "25882",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/25882"
        },
        {
          "name": "3191",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/3191"
        },
        {
          "name": "ADV-2007-3344",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2007/3344"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2007-5223",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple unspecified vulnerabilities in AlstraSoft Affiliate Network Pro allow remote attackers to include local files and have other unspecified impact, related to incorrect input validation or other defects involving (1) admin/backupstart.php, (2) a .sql filename under admin/admin/dump/, (3) a .sql filename in the fl parameter to admin/downloadbackup.php, and (4) a .. (dot dot) in the fl parameter to admin/downloadbackup.php."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "42342",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/42342"
            },
            {
              "name": "20070929 Affiliate Network Pro Multiple Input Validation and Local file inclusion",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/481206/100/0/threaded"
            },
            {
              "name": "42344",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/42344"
            },
            {
              "name": "42343",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/42343"
            },
            {
              "name": "25882",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/25882"
            },
            {
              "name": "3191",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/3191"
            },
            {
              "name": "ADV-2007-3344",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2007/3344"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2007-5223",
    "datePublished": "2007-10-05T00:00:00.000Z",
    "dateReserved": "2007-10-04T00:00:00.000Z",
    "dateUpdated": "2024-08-07T15:24:42.336Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2007-4084 (GCVE-0-2007-4084)

Vulnerability from nvd – Published: 2007-07-30 17:00 – Updated: 2024-08-07 14:46
VLAI?
Summary
Multiple SQL injection vulnerabilities in AlstraSoft Affiliate Network Pro allow remote attackers to execute arbitrary SQL commands via (1) the pgmid parameter in an uploadProducts action to merchants/index.php and possibly (2) the rowid parameter to merchants/temp.php.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://osvdb.org/37870 vdb-entryx_refsource_OSVDB
http://lostmon.blogspot.com/2007/07/alstrasoft-mu… x_refsource_MISC
http://www.securityfocus.com/bid/25026 vdb-entryx_refsource_BID
http://osvdb.org/37869 vdb-entryx_refsource_OSVDB
Date Public ?
2007-07-22 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T14:46:37.305Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "37870",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/37870"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://lostmon.blogspot.com/2007/07/alstrasoft-multiple-products-multiple.html"
          },
          {
            "name": "25026",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/25026"
          },
          {
            "name": "37869",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/37869"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2007-07-22T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple SQL injection vulnerabilities in AlstraSoft Affiliate Network Pro allow remote attackers to execute arbitrary SQL commands via (1) the pgmid parameter in an uploadProducts action to merchants/index.php and possibly (2) the rowid parameter to merchants/temp.php."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2008-11-15T10:00:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "37870",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/37870"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://lostmon.blogspot.com/2007/07/alstrasoft-multiple-products-multiple.html"
        },
        {
          "name": "25026",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/25026"
        },
        {
          "name": "37869",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/37869"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2007-4084",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple SQL injection vulnerabilities in AlstraSoft Affiliate Network Pro allow remote attackers to execute arbitrary SQL commands via (1) the pgmid parameter in an uploadProducts action to merchants/index.php and possibly (2) the rowid parameter to merchants/temp.php."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "37870",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/37870"
            },
            {
              "name": "http://lostmon.blogspot.com/2007/07/alstrasoft-multiple-products-multiple.html",
              "refsource": "MISC",
              "url": "http://lostmon.blogspot.com/2007/07/alstrasoft-multiple-products-multiple.html"
            },
            {
              "name": "25026",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/25026"
            },
            {
              "name": "37869",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/37869"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2007-4084",
    "datePublished": "2007-07-30T17:00:00.000Z",
    "dateReserved": "2007-07-30T00:00:00.000Z",
    "dateUpdated": "2024-08-07T14:46:37.305Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2007-4081 (GCVE-0-2007-4081)

Vulnerability from nvd – Published: 2007-07-30 17:00 – Updated: 2024-08-07 14:46
VLAI?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in AlstraSoft Affiliate Network Pro allow remote attackers to inject arbitrary web script or HTML via vectors in (a) merchants/index.php, including the (1) id or (2) msg parameter in a programedit action; the (3) pgmid parameter in an uploadProducts action; the (4) d, (5) m, or (6) y parameter in a daily action; the (7) err parameter in a ProgramReport action; the (8) i, (9) txtto, (10) txtfrom, or (11) programs parameter in a LinkReport action; or the (12) msg parameter in an add_money action; and one vector in (b) merchants/temp.php using (13) the rowid parameter. NOTE: vector 7 might overlap CVE-2005-3795.1.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://osvdb.org/46954 vdb-entryx_refsource_OSVDB
http://lostmon.blogspot.com/2007/07/alstrasoft-mu… x_refsource_MISC
http://osvdb.org/46953 vdb-entryx_refsource_OSVDB
http://www.securityfocus.com/bid/25026 vdb-entryx_refsource_BID
Date Public ?
2007-07-22 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T14:46:37.317Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "46954",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/46954"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://lostmon.blogspot.com/2007/07/alstrasoft-multiple-products-multiple.html"
          },
          {
            "name": "46953",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/46953"
          },
          {
            "name": "25026",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/25026"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2007-07-22T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple cross-site scripting (XSS) vulnerabilities in AlstraSoft Affiliate Network Pro allow remote attackers to inject arbitrary web script or HTML via vectors in (a) merchants/index.php, including the (1) id or (2) msg parameter in a programedit action; the (3) pgmid parameter in an uploadProducts action; the (4) d, (5) m, or (6) y parameter in a daily action; the (7) err parameter in a ProgramReport action; the (8) i, (9) txtto, (10) txtfrom, or (11) programs parameter in a LinkReport action; or the (12) msg parameter in an add_money action; and one vector in (b) merchants/temp.php using (13) the rowid parameter.  NOTE: vector 7 might overlap CVE-2005-3795.1."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2008-11-15T10:00:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "46954",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/46954"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://lostmon.blogspot.com/2007/07/alstrasoft-multiple-products-multiple.html"
        },
        {
          "name": "46953",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/46953"
        },
        {
          "name": "25026",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/25026"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2007-4081",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple cross-site scripting (XSS) vulnerabilities in AlstraSoft Affiliate Network Pro allow remote attackers to inject arbitrary web script or HTML via vectors in (a) merchants/index.php, including the (1) id or (2) msg parameter in a programedit action; the (3) pgmid parameter in an uploadProducts action; the (4) d, (5) m, or (6) y parameter in a daily action; the (7) err parameter in a ProgramReport action; the (8) i, (9) txtto, (10) txtfrom, or (11) programs parameter in a LinkReport action; or the (12) msg parameter in an add_money action; and one vector in (b) merchants/temp.php using (13) the rowid parameter.  NOTE: vector 7 might overlap CVE-2005-3795.1."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "46954",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/46954"
            },
            {
              "name": "http://lostmon.blogspot.com/2007/07/alstrasoft-multiple-products-multiple.html",
              "refsource": "MISC",
              "url": "http://lostmon.blogspot.com/2007/07/alstrasoft-multiple-products-multiple.html"
            },
            {
              "name": "46953",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/46953"
            },
            {
              "name": "25026",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/25026"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2007-4081",
    "datePublished": "2007-07-30T17:00:00.000Z",
    "dateReserved": "2007-07-30T00:00:00.000Z",
    "dateUpdated": "2024-08-07T14:46:37.317Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2005-3793 (GCVE-0-2005-3793)

Vulnerability from nvd – Published: 2005-11-24 11:00 – Updated: 2024-08-07 23:24
VLAI?
Summary
Multiple SQL injection vulnerabilities in AlstraSoft Affiliate Network Pro 7.2 allow remote attackers to bypass authentication and execute arbitrary SQL commands via the (1) username or (2) password to admin/admin_validate_login, or the (3) login, (4) password, and (5) flag parameters to login_validate.php.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://myblog.it-security23.net/?postid=5 x_refsource_MISC
http://www.osvdb.org/20893 vdb-entryx_refsource_OSVDB
https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
http://www.vupen.com/english/advisories/2005/2455 vdb-entryx_refsource_VUPEN
http://marc.info/?l=bugtraq&m=113209435819541&w=2 mailing-listx_refsource_BUGTRAQ
http://www.osvdb.org/20889 vdb-entryx_refsource_OSVDB
http://secunia.com/advisories/17605/ third-party-advisoryx_refsource_SECUNIA
Date Public ?
2005-11-15 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T23:24:36.213Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://myblog.it-security23.net/?postid=5"
          },
          {
            "name": "20893",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/20893"
          },
          {
            "name": "affiliate-network-login-sql-injection(23073)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/23073"
          },
          {
            "name": "ADV-2005-2455",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2005/2455"
          },
          {
            "name": "20051115 Affiliate Network Pro v7.2 SQL Injections, Arbitrary code execution, XSS",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=113209435819541\u0026w=2"
          },
          {
            "name": "20889",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/20889"
          },
          {
            "name": "17605",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/17605/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2005-11-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple SQL injection vulnerabilities in AlstraSoft Affiliate Network Pro 7.2 allow remote attackers to bypass authentication and execute arbitrary SQL commands via the (1) username or (2) password to admin/admin_validate_login, or the (3) login, (4) password, and (5) flag parameters to login_validate.php."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-07-10T14:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://myblog.it-security23.net/?postid=5"
        },
        {
          "name": "20893",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/20893"
        },
        {
          "name": "affiliate-network-login-sql-injection(23073)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/23073"
        },
        {
          "name": "ADV-2005-2455",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2005/2455"
        },
        {
          "name": "20051115 Affiliate Network Pro v7.2 SQL Injections, Arbitrary code execution, XSS",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=113209435819541\u0026w=2"
        },
        {
          "name": "20889",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/20889"
        },
        {
          "name": "17605",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/17605/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2005-3793",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple SQL injection vulnerabilities in AlstraSoft Affiliate Network Pro 7.2 allow remote attackers to bypass authentication and execute arbitrary SQL commands via the (1) username or (2) password to admin/admin_validate_login, or the (3) login, (4) password, and (5) flag parameters to login_validate.php."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://myblog.it-security23.net/?postid=5",
              "refsource": "MISC",
              "url": "http://myblog.it-security23.net/?postid=5"
            },
            {
              "name": "20893",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/20893"
            },
            {
              "name": "affiliate-network-login-sql-injection(23073)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/23073"
            },
            {
              "name": "ADV-2005-2455",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2005/2455"
            },
            {
              "name": "20051115 Affiliate Network Pro v7.2 SQL Injections, Arbitrary code execution, XSS",
              "refsource": "BUGTRAQ",
              "url": "http://marc.info/?l=bugtraq\u0026m=113209435819541\u0026w=2"
            },
            {
              "name": "20889",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/20889"
            },
            {
              "name": "17605",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/17605/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2005-3793",
    "datePublished": "2005-11-24T11:00:00.000Z",
    "dateReserved": "2005-11-24T00:00:00.000Z",
    "dateUpdated": "2024-08-07T23:24:36.213Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2005-3795 (GCVE-0-2005-3795)

Vulnerability from nvd – Published: 2005-11-24 11:00 – Updated: 2024-08-07 23:24
VLAI?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in AlstraSoft Affiliate Network Pro 7.2 allow remote attackers to inject arbitrary web script or HTML via (1) the Err parameter in admin/index.php and the (2) firstname and (3) lastname parameters in index.php.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://myblog.it-security23.net/?postid=5 x_refsource_MISC
http://www.osvdb.org/20891 vdb-entryx_refsource_OSVDB
https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
http://www.vupen.com/english/advisories/2005/2455 vdb-entryx_refsource_VUPEN
http://marc.info/?l=bugtraq&m=113209435819541&w=2 mailing-listx_refsource_BUGTRAQ
http://www.osvdb.org/20892 vdb-entryx_refsource_OSVDB
http://secunia.com/advisories/17605/ third-party-advisoryx_refsource_SECUNIA
Date Public ?
2005-11-15 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T23:24:36.365Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://myblog.it-security23.net/?postid=5"
          },
          {
            "name": "20891",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/20891"
          },
          {
            "name": "affiliate-network-index-xss(23075)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/23075"
          },
          {
            "name": "ADV-2005-2455",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2005/2455"
          },
          {
            "name": "20051115 Affiliate Network Pro v7.2 SQL Injections, Arbitrary code execution, XSS",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=113209435819541\u0026w=2"
          },
          {
            "name": "20892",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/20892"
          },
          {
            "name": "17605",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/17605/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2005-11-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple cross-site scripting (XSS) vulnerabilities in AlstraSoft Affiliate Network Pro 7.2 allow remote attackers to inject arbitrary web script or HTML via (1) the Err parameter in admin/index.php and the (2) firstname and (3) lastname parameters in index.php."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-07-10T14:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://myblog.it-security23.net/?postid=5"
        },
        {
          "name": "20891",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/20891"
        },
        {
          "name": "affiliate-network-index-xss(23075)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/23075"
        },
        {
          "name": "ADV-2005-2455",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2005/2455"
        },
        {
          "name": "20051115 Affiliate Network Pro v7.2 SQL Injections, Arbitrary code execution, XSS",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=113209435819541\u0026w=2"
        },
        {
          "name": "20892",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/20892"
        },
        {
          "name": "17605",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/17605/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2005-3795",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple cross-site scripting (XSS) vulnerabilities in AlstraSoft Affiliate Network Pro 7.2 allow remote attackers to inject arbitrary web script or HTML via (1) the Err parameter in admin/index.php and the (2) firstname and (3) lastname parameters in index.php."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://myblog.it-security23.net/?postid=5",
              "refsource": "MISC",
              "url": "http://myblog.it-security23.net/?postid=5"
            },
            {
              "name": "20891",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/20891"
            },
            {
              "name": "affiliate-network-index-xss(23075)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/23075"
            },
            {
              "name": "ADV-2005-2455",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2005/2455"
            },
            {
              "name": "20051115 Affiliate Network Pro v7.2 SQL Injections, Arbitrary code execution, XSS",
              "refsource": "BUGTRAQ",
              "url": "http://marc.info/?l=bugtraq\u0026m=113209435819541\u0026w=2"
            },
            {
              "name": "20892",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/20892"
            },
            {
              "name": "17605",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/17605/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2005-3795",
    "datePublished": "2005-11-24T11:00:00.000Z",
    "dateReserved": "2005-11-24T00:00:00.000Z",
    "dateUpdated": "2024-08-07T23:24:36.365Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2005-3794 (GCVE-0-2005-3794)

Vulnerability from nvd – Published: 2005-11-24 11:00 – Updated: 2024-08-07 23:24
VLAI?
Summary
AlstraSoft Affiliate Network Pro 7.2 allows remote attackers to obtain sensitive information via a direct request to scripts such as (1) togateway.php and (2) other unspecified scripts.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Date Public ?
2005-11-15 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T23:24:36.228Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://myblog.it-security23.net/?postid=5"
          },
          {
            "name": "affiliate-network-information-disclosure(23078)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/23078"
          },
          {
            "name": "ADV-2005-2455",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2005/2455"
          },
          {
            "name": "20051115 Affiliate Network Pro v7.2 SQL Injections, Arbitrary code execution, XSS",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=113209435819541\u0026w=2"
          },
          {
            "name": "17605",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/17605/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2005-11-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "AlstraSoft Affiliate Network Pro 7.2 allows remote attackers to obtain sensitive information via a direct request to scripts such as (1) togateway.php and (2) other unspecified scripts."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-07-10T14:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://myblog.it-security23.net/?postid=5"
        },
        {
          "name": "affiliate-network-information-disclosure(23078)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/23078"
        },
        {
          "name": "ADV-2005-2455",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2005/2455"
        },
        {
          "name": "20051115 Affiliate Network Pro v7.2 SQL Injections, Arbitrary code execution, XSS",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=113209435819541\u0026w=2"
        },
        {
          "name": "17605",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/17605/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2005-3794",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "AlstraSoft Affiliate Network Pro 7.2 allows remote attackers to obtain sensitive information via a direct request to scripts such as (1) togateway.php and (2) other unspecified scripts."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://myblog.it-security23.net/?postid=5",
              "refsource": "MISC",
              "url": "http://myblog.it-security23.net/?postid=5"
            },
            {
              "name": "affiliate-network-information-disclosure(23078)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/23078"
            },
            {
              "name": "ADV-2005-2455",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2005/2455"
            },
            {
              "name": "20051115 Affiliate Network Pro v7.2 SQL Injections, Arbitrary code execution, XSS",
              "refsource": "BUGTRAQ",
              "url": "http://marc.info/?l=bugtraq\u0026m=113209435819541\u0026w=2"
            },
            {
              "name": "17605",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/17605/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2005-3794",
    "datePublished": "2005-11-24T11:00:00.000Z",
    "dateReserved": "2005-11-24T00:00:00.000Z",
    "dateUpdated": "2024-08-07T23:24:36.228Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2005-3796 (GCVE-0-2005-3796)

Vulnerability from nvd – Published: 2005-11-24 11:00 – Updated: 2024-08-07 23:24
VLAI?
Summary
Direct static code injection vulnerability in admin_options_manage.php in AlstraSoft Affiliate Network Pro 7.2 allows attackers to execute arbitrary PHP code via the number parameter. NOTE: it is not clear from the original report whether administrator privileges are required. If not, then this does not cross privilege boundaries and is not a vulnerability.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://myblog.it-security23.net/?postid=5 x_refsource_MISC
http://securityreason.com/securityalert/184 third-party-advisoryx_refsource_SREASON
http://www.osvdb.org/20890 vdb-entryx_refsource_OSVDB
http://www.vupen.com/english/advisories/2005/2455 vdb-entryx_refsource_VUPEN
http://marc.info/?l=bugtraq&m=113209435819541&w=2 mailing-listx_refsource_BUGTRAQ
http://secunia.com/advisories/17605/ third-party-advisoryx_refsource_SECUNIA
https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
Date Public ?
2005-11-15 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T23:24:36.310Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://myblog.it-security23.net/?postid=5"
          },
          {
            "name": "184",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/184"
          },
          {
            "name": "20890",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/20890"
          },
          {
            "name": "ADV-2005-2455",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2005/2455"
          },
          {
            "name": "20051115 Affiliate Network Pro v7.2 SQL Injections, Arbitrary code execution, XSS",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=113209435819541\u0026w=2"
          },
          {
            "name": "17605",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/17605/"
          },
          {
            "name": "affiliate-network-php-code-injection(23076)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/23076"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2005-11-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Direct static code injection vulnerability in admin_options_manage.php in AlstraSoft Affiliate Network Pro 7.2 allows attackers to execute arbitrary PHP code via the number parameter.  NOTE: it is not clear from the original report whether administrator privileges are required.  If not, then this does not cross privilege boundaries and is not a vulnerability."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-07-10T14:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://myblog.it-security23.net/?postid=5"
        },
        {
          "name": "184",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/184"
        },
        {
          "name": "20890",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/20890"
        },
        {
          "name": "ADV-2005-2455",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2005/2455"
        },
        {
          "name": "20051115 Affiliate Network Pro v7.2 SQL Injections, Arbitrary code execution, XSS",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=113209435819541\u0026w=2"
        },
        {
          "name": "17605",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/17605/"
        },
        {
          "name": "affiliate-network-php-code-injection(23076)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/23076"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2005-3796",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Direct static code injection vulnerability in admin_options_manage.php in AlstraSoft Affiliate Network Pro 7.2 allows attackers to execute arbitrary PHP code via the number parameter.  NOTE: it is not clear from the original report whether administrator privileges are required.  If not, then this does not cross privilege boundaries and is not a vulnerability."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://myblog.it-security23.net/?postid=5",
              "refsource": "MISC",
              "url": "http://myblog.it-security23.net/?postid=5"
            },
            {
              "name": "184",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/184"
            },
            {
              "name": "20890",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/20890"
            },
            {
              "name": "ADV-2005-2455",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2005/2455"
            },
            {
              "name": "20051115 Affiliate Network Pro v7.2 SQL Injections, Arbitrary code execution, XSS",
              "refsource": "BUGTRAQ",
              "url": "http://marc.info/?l=bugtraq\u0026m=113209435819541\u0026w=2"
            },
            {
              "name": "17605",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/17605/"
            },
            {
              "name": "affiliate-network-php-code-injection(23076)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/23076"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2005-3796",
    "datePublished": "2005-11-24T11:00:00.000Z",
    "dateReserved": "2005-11-24T00:00:00.000Z",
    "dateUpdated": "2024-08-07T23:24:36.310Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2008-3240 (GCVE-0-2008-3240)

Vulnerability from cvelistv5 – Published: 2008-07-21 16:00 – Updated: 2024-08-07 09:28
VLAI?
Summary
SQL injection vulnerability in index.php in AlstraSoft Affiliate Network Pro allows remote attackers to execute arbitrary SQL commands via the pgm parameter in a directory action.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://securityreason.com/securityalert/4016 third-party-advisoryx_refsource_SREASON
http://www.securityfocus.com/bid/30259 vdb-entryx_refsource_BID
https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
https://www.exploit-db.com/exploits/6087 exploitx_refsource_EXPLOIT-DB
http://secunia.com/advisories/31112 third-party-advisoryx_refsource_SECUNIA
http://www.vupen.com/english/advisories/2008/2122… vdb-entryx_refsource_VUPEN
Date Public ?
2008-07-16 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T09:28:41.835Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "4016",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/4016"
          },
          {
            "name": "30259",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/30259"
          },
          {
            "name": "alstrasoft-pgm-sql-injection(43848)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43848"
          },
          {
            "name": "6087",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/6087"
          },
          {
            "name": "31112",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/31112"
          },
          {
            "name": "ADV-2008-2122",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2008/2122/references"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2008-07-16T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SQL injection vulnerability in index.php in AlstraSoft Affiliate Network Pro allows remote attackers to execute arbitrary SQL commands via the pgm parameter in a directory action."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-09-28T12:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "4016",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/4016"
        },
        {
          "name": "30259",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/30259"
        },
        {
          "name": "alstrasoft-pgm-sql-injection(43848)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43848"
        },
        {
          "name": "6087",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/6087"
        },
        {
          "name": "31112",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/31112"
        },
        {
          "name": "ADV-2008-2122",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2008/2122/references"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2008-3240",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "SQL injection vulnerability in index.php in AlstraSoft Affiliate Network Pro allows remote attackers to execute arbitrary SQL commands via the pgm parameter in a directory action."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "4016",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/4016"
            },
            {
              "name": "30259",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/30259"
            },
            {
              "name": "alstrasoft-pgm-sql-injection(43848)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43848"
            },
            {
              "name": "6087",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/6087"
            },
            {
              "name": "31112",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/31112"
            },
            {
              "name": "ADV-2008-2122",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2008/2122/references"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2008-3240",
    "datePublished": "2008-07-21T16:00:00.000Z",
    "dateReserved": "2008-07-21T00:00:00.000Z",
    "dateUpdated": "2024-08-07T09:28:41.835Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2007-5223 (GCVE-0-2007-5223)

Vulnerability from cvelistv5 – Published: 2007-10-05 00:00 – Updated: 2024-08-07 15:24
VLAI?
Summary
Multiple unspecified vulnerabilities in AlstraSoft Affiliate Network Pro allow remote attackers to include local files and have other unspecified impact, related to incorrect input validation or other defects involving (1) admin/backupstart.php, (2) a .sql filename under admin/admin/dump/, (3) a .sql filename in the fl parameter to admin/downloadbackup.php, and (4) a .. (dot dot) in the fl parameter to admin/downloadbackup.php.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://osvdb.org/42342 vdb-entryx_refsource_OSVDB
http://www.securityfocus.com/archive/1/481206/100… mailing-listx_refsource_BUGTRAQ
http://osvdb.org/42344 vdb-entryx_refsource_OSVDB
http://osvdb.org/42343 vdb-entryx_refsource_OSVDB
http://www.securityfocus.com/bid/25882 vdb-entryx_refsource_BID
http://securityreason.com/securityalert/3191 third-party-advisoryx_refsource_SREASON
http://www.vupen.com/english/advisories/2007/3344 vdb-entryx_refsource_VUPEN
Date Public ?
2007-09-29 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T15:24:42.336Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "42342",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/42342"
          },
          {
            "name": "20070929 Affiliate Network Pro Multiple Input Validation and Local file inclusion",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/481206/100/0/threaded"
          },
          {
            "name": "42344",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/42344"
          },
          {
            "name": "42343",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/42343"
          },
          {
            "name": "25882",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/25882"
          },
          {
            "name": "3191",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/3191"
          },
          {
            "name": "ADV-2007-3344",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2007/3344"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2007-09-29T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple unspecified vulnerabilities in AlstraSoft Affiliate Network Pro allow remote attackers to include local files and have other unspecified impact, related to incorrect input validation or other defects involving (1) admin/backupstart.php, (2) a .sql filename under admin/admin/dump/, (3) a .sql filename in the fl parameter to admin/downloadbackup.php, and (4) a .. (dot dot) in the fl parameter to admin/downloadbackup.php."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-15T20:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "42342",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/42342"
        },
        {
          "name": "20070929 Affiliate Network Pro Multiple Input Validation and Local file inclusion",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/481206/100/0/threaded"
        },
        {
          "name": "42344",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/42344"
        },
        {
          "name": "42343",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/42343"
        },
        {
          "name": "25882",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/25882"
        },
        {
          "name": "3191",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/3191"
        },
        {
          "name": "ADV-2007-3344",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2007/3344"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2007-5223",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple unspecified vulnerabilities in AlstraSoft Affiliate Network Pro allow remote attackers to include local files and have other unspecified impact, related to incorrect input validation or other defects involving (1) admin/backupstart.php, (2) a .sql filename under admin/admin/dump/, (3) a .sql filename in the fl parameter to admin/downloadbackup.php, and (4) a .. (dot dot) in the fl parameter to admin/downloadbackup.php."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "42342",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/42342"
            },
            {
              "name": "20070929 Affiliate Network Pro Multiple Input Validation and Local file inclusion",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/481206/100/0/threaded"
            },
            {
              "name": "42344",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/42344"
            },
            {
              "name": "42343",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/42343"
            },
            {
              "name": "25882",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/25882"
            },
            {
              "name": "3191",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/3191"
            },
            {
              "name": "ADV-2007-3344",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2007/3344"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2007-5223",
    "datePublished": "2007-10-05T00:00:00.000Z",
    "dateReserved": "2007-10-04T00:00:00.000Z",
    "dateUpdated": "2024-08-07T15:24:42.336Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2007-4084 (GCVE-0-2007-4084)

Vulnerability from cvelistv5 – Published: 2007-07-30 17:00 – Updated: 2024-08-07 14:46
VLAI?
Summary
Multiple SQL injection vulnerabilities in AlstraSoft Affiliate Network Pro allow remote attackers to execute arbitrary SQL commands via (1) the pgmid parameter in an uploadProducts action to merchants/index.php and possibly (2) the rowid parameter to merchants/temp.php.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://osvdb.org/37870 vdb-entryx_refsource_OSVDB
http://lostmon.blogspot.com/2007/07/alstrasoft-mu… x_refsource_MISC
http://www.securityfocus.com/bid/25026 vdb-entryx_refsource_BID
http://osvdb.org/37869 vdb-entryx_refsource_OSVDB
Date Public ?
2007-07-22 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T14:46:37.305Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "37870",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/37870"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://lostmon.blogspot.com/2007/07/alstrasoft-multiple-products-multiple.html"
          },
          {
            "name": "25026",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/25026"
          },
          {
            "name": "37869",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/37869"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2007-07-22T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple SQL injection vulnerabilities in AlstraSoft Affiliate Network Pro allow remote attackers to execute arbitrary SQL commands via (1) the pgmid parameter in an uploadProducts action to merchants/index.php and possibly (2) the rowid parameter to merchants/temp.php."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2008-11-15T10:00:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "37870",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/37870"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://lostmon.blogspot.com/2007/07/alstrasoft-multiple-products-multiple.html"
        },
        {
          "name": "25026",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/25026"
        },
        {
          "name": "37869",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/37869"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2007-4084",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple SQL injection vulnerabilities in AlstraSoft Affiliate Network Pro allow remote attackers to execute arbitrary SQL commands via (1) the pgmid parameter in an uploadProducts action to merchants/index.php and possibly (2) the rowid parameter to merchants/temp.php."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "37870",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/37870"
            },
            {
              "name": "http://lostmon.blogspot.com/2007/07/alstrasoft-multiple-products-multiple.html",
              "refsource": "MISC",
              "url": "http://lostmon.blogspot.com/2007/07/alstrasoft-multiple-products-multiple.html"
            },
            {
              "name": "25026",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/25026"
            },
            {
              "name": "37869",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/37869"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2007-4084",
    "datePublished": "2007-07-30T17:00:00.000Z",
    "dateReserved": "2007-07-30T00:00:00.000Z",
    "dateUpdated": "2024-08-07T14:46:37.305Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2007-4081 (GCVE-0-2007-4081)

Vulnerability from cvelistv5 – Published: 2007-07-30 17:00 – Updated: 2024-08-07 14:46
VLAI?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in AlstraSoft Affiliate Network Pro allow remote attackers to inject arbitrary web script or HTML via vectors in (a) merchants/index.php, including the (1) id or (2) msg parameter in a programedit action; the (3) pgmid parameter in an uploadProducts action; the (4) d, (5) m, or (6) y parameter in a daily action; the (7) err parameter in a ProgramReport action; the (8) i, (9) txtto, (10) txtfrom, or (11) programs parameter in a LinkReport action; or the (12) msg parameter in an add_money action; and one vector in (b) merchants/temp.php using (13) the rowid parameter. NOTE: vector 7 might overlap CVE-2005-3795.1.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://osvdb.org/46954 vdb-entryx_refsource_OSVDB
http://lostmon.blogspot.com/2007/07/alstrasoft-mu… x_refsource_MISC
http://osvdb.org/46953 vdb-entryx_refsource_OSVDB
http://www.securityfocus.com/bid/25026 vdb-entryx_refsource_BID
Date Public ?
2007-07-22 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T14:46:37.317Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "46954",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/46954"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://lostmon.blogspot.com/2007/07/alstrasoft-multiple-products-multiple.html"
          },
          {
            "name": "46953",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/46953"
          },
          {
            "name": "25026",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/25026"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2007-07-22T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple cross-site scripting (XSS) vulnerabilities in AlstraSoft Affiliate Network Pro allow remote attackers to inject arbitrary web script or HTML via vectors in (a) merchants/index.php, including the (1) id or (2) msg parameter in a programedit action; the (3) pgmid parameter in an uploadProducts action; the (4) d, (5) m, or (6) y parameter in a daily action; the (7) err parameter in a ProgramReport action; the (8) i, (9) txtto, (10) txtfrom, or (11) programs parameter in a LinkReport action; or the (12) msg parameter in an add_money action; and one vector in (b) merchants/temp.php using (13) the rowid parameter.  NOTE: vector 7 might overlap CVE-2005-3795.1."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2008-11-15T10:00:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "46954",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/46954"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://lostmon.blogspot.com/2007/07/alstrasoft-multiple-products-multiple.html"
        },
        {
          "name": "46953",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/46953"
        },
        {
          "name": "25026",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/25026"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2007-4081",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple cross-site scripting (XSS) vulnerabilities in AlstraSoft Affiliate Network Pro allow remote attackers to inject arbitrary web script or HTML via vectors in (a) merchants/index.php, including the (1) id or (2) msg parameter in a programedit action; the (3) pgmid parameter in an uploadProducts action; the (4) d, (5) m, or (6) y parameter in a daily action; the (7) err parameter in a ProgramReport action; the (8) i, (9) txtto, (10) txtfrom, or (11) programs parameter in a LinkReport action; or the (12) msg parameter in an add_money action; and one vector in (b) merchants/temp.php using (13) the rowid parameter.  NOTE: vector 7 might overlap CVE-2005-3795.1."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "46954",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/46954"
            },
            {
              "name": "http://lostmon.blogspot.com/2007/07/alstrasoft-multiple-products-multiple.html",
              "refsource": "MISC",
              "url": "http://lostmon.blogspot.com/2007/07/alstrasoft-multiple-products-multiple.html"
            },
            {
              "name": "46953",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/46953"
            },
            {
              "name": "25026",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/25026"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2007-4081",
    "datePublished": "2007-07-30T17:00:00.000Z",
    "dateReserved": "2007-07-30T00:00:00.000Z",
    "dateUpdated": "2024-08-07T14:46:37.317Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2005-3793 (GCVE-0-2005-3793)

Vulnerability from cvelistv5 – Published: 2005-11-24 11:00 – Updated: 2024-08-07 23:24
VLAI?
Summary
Multiple SQL injection vulnerabilities in AlstraSoft Affiliate Network Pro 7.2 allow remote attackers to bypass authentication and execute arbitrary SQL commands via the (1) username or (2) password to admin/admin_validate_login, or the (3) login, (4) password, and (5) flag parameters to login_validate.php.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://myblog.it-security23.net/?postid=5 x_refsource_MISC
http://www.osvdb.org/20893 vdb-entryx_refsource_OSVDB
https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
http://www.vupen.com/english/advisories/2005/2455 vdb-entryx_refsource_VUPEN
http://marc.info/?l=bugtraq&m=113209435819541&w=2 mailing-listx_refsource_BUGTRAQ
http://www.osvdb.org/20889 vdb-entryx_refsource_OSVDB
http://secunia.com/advisories/17605/ third-party-advisoryx_refsource_SECUNIA
Date Public ?
2005-11-15 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T23:24:36.213Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://myblog.it-security23.net/?postid=5"
          },
          {
            "name": "20893",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/20893"
          },
          {
            "name": "affiliate-network-login-sql-injection(23073)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/23073"
          },
          {
            "name": "ADV-2005-2455",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2005/2455"
          },
          {
            "name": "20051115 Affiliate Network Pro v7.2 SQL Injections, Arbitrary code execution, XSS",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=113209435819541\u0026w=2"
          },
          {
            "name": "20889",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/20889"
          },
          {
            "name": "17605",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/17605/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2005-11-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple SQL injection vulnerabilities in AlstraSoft Affiliate Network Pro 7.2 allow remote attackers to bypass authentication and execute arbitrary SQL commands via the (1) username or (2) password to admin/admin_validate_login, or the (3) login, (4) password, and (5) flag parameters to login_validate.php."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-07-10T14:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://myblog.it-security23.net/?postid=5"
        },
        {
          "name": "20893",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/20893"
        },
        {
          "name": "affiliate-network-login-sql-injection(23073)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/23073"
        },
        {
          "name": "ADV-2005-2455",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2005/2455"
        },
        {
          "name": "20051115 Affiliate Network Pro v7.2 SQL Injections, Arbitrary code execution, XSS",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=113209435819541\u0026w=2"
        },
        {
          "name": "20889",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/20889"
        },
        {
          "name": "17605",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/17605/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2005-3793",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple SQL injection vulnerabilities in AlstraSoft Affiliate Network Pro 7.2 allow remote attackers to bypass authentication and execute arbitrary SQL commands via the (1) username or (2) password to admin/admin_validate_login, or the (3) login, (4) password, and (5) flag parameters to login_validate.php."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://myblog.it-security23.net/?postid=5",
              "refsource": "MISC",
              "url": "http://myblog.it-security23.net/?postid=5"
            },
            {
              "name": "20893",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/20893"
            },
            {
              "name": "affiliate-network-login-sql-injection(23073)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/23073"
            },
            {
              "name": "ADV-2005-2455",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2005/2455"
            },
            {
              "name": "20051115 Affiliate Network Pro v7.2 SQL Injections, Arbitrary code execution, XSS",
              "refsource": "BUGTRAQ",
              "url": "http://marc.info/?l=bugtraq\u0026m=113209435819541\u0026w=2"
            },
            {
              "name": "20889",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/20889"
            },
            {
              "name": "17605",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/17605/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2005-3793",
    "datePublished": "2005-11-24T11:00:00.000Z",
    "dateReserved": "2005-11-24T00:00:00.000Z",
    "dateUpdated": "2024-08-07T23:24:36.213Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2005-3795 (GCVE-0-2005-3795)

Vulnerability from cvelistv5 – Published: 2005-11-24 11:00 – Updated: 2024-08-07 23:24
VLAI?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in AlstraSoft Affiliate Network Pro 7.2 allow remote attackers to inject arbitrary web script or HTML via (1) the Err parameter in admin/index.php and the (2) firstname and (3) lastname parameters in index.php.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://myblog.it-security23.net/?postid=5 x_refsource_MISC
http://www.osvdb.org/20891 vdb-entryx_refsource_OSVDB
https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
http://www.vupen.com/english/advisories/2005/2455 vdb-entryx_refsource_VUPEN
http://marc.info/?l=bugtraq&m=113209435819541&w=2 mailing-listx_refsource_BUGTRAQ
http://www.osvdb.org/20892 vdb-entryx_refsource_OSVDB
http://secunia.com/advisories/17605/ third-party-advisoryx_refsource_SECUNIA
Date Public ?
2005-11-15 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T23:24:36.365Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://myblog.it-security23.net/?postid=5"
          },
          {
            "name": "20891",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/20891"
          },
          {
            "name": "affiliate-network-index-xss(23075)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/23075"
          },
          {
            "name": "ADV-2005-2455",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2005/2455"
          },
          {
            "name": "20051115 Affiliate Network Pro v7.2 SQL Injections, Arbitrary code execution, XSS",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=113209435819541\u0026w=2"
          },
          {
            "name": "20892",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/20892"
          },
          {
            "name": "17605",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/17605/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2005-11-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple cross-site scripting (XSS) vulnerabilities in AlstraSoft Affiliate Network Pro 7.2 allow remote attackers to inject arbitrary web script or HTML via (1) the Err parameter in admin/index.php and the (2) firstname and (3) lastname parameters in index.php."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-07-10T14:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://myblog.it-security23.net/?postid=5"
        },
        {
          "name": "20891",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/20891"
        },
        {
          "name": "affiliate-network-index-xss(23075)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/23075"
        },
        {
          "name": "ADV-2005-2455",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2005/2455"
        },
        {
          "name": "20051115 Affiliate Network Pro v7.2 SQL Injections, Arbitrary code execution, XSS",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=113209435819541\u0026w=2"
        },
        {
          "name": "20892",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/20892"
        },
        {
          "name": "17605",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/17605/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2005-3795",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple cross-site scripting (XSS) vulnerabilities in AlstraSoft Affiliate Network Pro 7.2 allow remote attackers to inject arbitrary web script or HTML via (1) the Err parameter in admin/index.php and the (2) firstname and (3) lastname parameters in index.php."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://myblog.it-security23.net/?postid=5",
              "refsource": "MISC",
              "url": "http://myblog.it-security23.net/?postid=5"
            },
            {
              "name": "20891",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/20891"
            },
            {
              "name": "affiliate-network-index-xss(23075)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/23075"
            },
            {
              "name": "ADV-2005-2455",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2005/2455"
            },
            {
              "name": "20051115 Affiliate Network Pro v7.2 SQL Injections, Arbitrary code execution, XSS",
              "refsource": "BUGTRAQ",
              "url": "http://marc.info/?l=bugtraq\u0026m=113209435819541\u0026w=2"
            },
            {
              "name": "20892",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/20892"
            },
            {
              "name": "17605",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/17605/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2005-3795",
    "datePublished": "2005-11-24T11:00:00.000Z",
    "dateReserved": "2005-11-24T00:00:00.000Z",
    "dateUpdated": "2024-08-07T23:24:36.365Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2005-3794 (GCVE-0-2005-3794)

Vulnerability from cvelistv5 – Published: 2005-11-24 11:00 – Updated: 2024-08-07 23:24
VLAI?
Summary
AlstraSoft Affiliate Network Pro 7.2 allows remote attackers to obtain sensitive information via a direct request to scripts such as (1) togateway.php and (2) other unspecified scripts.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Date Public ?
2005-11-15 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T23:24:36.228Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://myblog.it-security23.net/?postid=5"
          },
          {
            "name": "affiliate-network-information-disclosure(23078)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/23078"
          },
          {
            "name": "ADV-2005-2455",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2005/2455"
          },
          {
            "name": "20051115 Affiliate Network Pro v7.2 SQL Injections, Arbitrary code execution, XSS",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=113209435819541\u0026w=2"
          },
          {
            "name": "17605",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/17605/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2005-11-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "AlstraSoft Affiliate Network Pro 7.2 allows remote attackers to obtain sensitive information via a direct request to scripts such as (1) togateway.php and (2) other unspecified scripts."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-07-10T14:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://myblog.it-security23.net/?postid=5"
        },
        {
          "name": "affiliate-network-information-disclosure(23078)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/23078"
        },
        {
          "name": "ADV-2005-2455",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2005/2455"
        },
        {
          "name": "20051115 Affiliate Network Pro v7.2 SQL Injections, Arbitrary code execution, XSS",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=113209435819541\u0026w=2"
        },
        {
          "name": "17605",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/17605/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2005-3794",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "AlstraSoft Affiliate Network Pro 7.2 allows remote attackers to obtain sensitive information via a direct request to scripts such as (1) togateway.php and (2) other unspecified scripts."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://myblog.it-security23.net/?postid=5",
              "refsource": "MISC",
              "url": "http://myblog.it-security23.net/?postid=5"
            },
            {
              "name": "affiliate-network-information-disclosure(23078)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/23078"
            },
            {
              "name": "ADV-2005-2455",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2005/2455"
            },
            {
              "name": "20051115 Affiliate Network Pro v7.2 SQL Injections, Arbitrary code execution, XSS",
              "refsource": "BUGTRAQ",
              "url": "http://marc.info/?l=bugtraq\u0026m=113209435819541\u0026w=2"
            },
            {
              "name": "17605",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/17605/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2005-3794",
    "datePublished": "2005-11-24T11:00:00.000Z",
    "dateReserved": "2005-11-24T00:00:00.000Z",
    "dateUpdated": "2024-08-07T23:24:36.228Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2005-3796 (GCVE-0-2005-3796)

Vulnerability from cvelistv5 – Published: 2005-11-24 11:00 – Updated: 2024-08-07 23:24
VLAI?
Summary
Direct static code injection vulnerability in admin_options_manage.php in AlstraSoft Affiliate Network Pro 7.2 allows attackers to execute arbitrary PHP code via the number parameter. NOTE: it is not clear from the original report whether administrator privileges are required. If not, then this does not cross privilege boundaries and is not a vulnerability.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://myblog.it-security23.net/?postid=5 x_refsource_MISC
http://securityreason.com/securityalert/184 third-party-advisoryx_refsource_SREASON
http://www.osvdb.org/20890 vdb-entryx_refsource_OSVDB
http://www.vupen.com/english/advisories/2005/2455 vdb-entryx_refsource_VUPEN
http://marc.info/?l=bugtraq&m=113209435819541&w=2 mailing-listx_refsource_BUGTRAQ
http://secunia.com/advisories/17605/ third-party-advisoryx_refsource_SECUNIA
https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
Date Public ?
2005-11-15 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T23:24:36.310Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://myblog.it-security23.net/?postid=5"
          },
          {
            "name": "184",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/184"
          },
          {
            "name": "20890",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/20890"
          },
          {
            "name": "ADV-2005-2455",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2005/2455"
          },
          {
            "name": "20051115 Affiliate Network Pro v7.2 SQL Injections, Arbitrary code execution, XSS",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=113209435819541\u0026w=2"
          },
          {
            "name": "17605",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/17605/"
          },
          {
            "name": "affiliate-network-php-code-injection(23076)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/23076"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2005-11-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Direct static code injection vulnerability in admin_options_manage.php in AlstraSoft Affiliate Network Pro 7.2 allows attackers to execute arbitrary PHP code via the number parameter.  NOTE: it is not clear from the original report whether administrator privileges are required.  If not, then this does not cross privilege boundaries and is not a vulnerability."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-07-10T14:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://myblog.it-security23.net/?postid=5"
        },
        {
          "name": "184",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/184"
        },
        {
          "name": "20890",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/20890"
        },
        {
          "name": "ADV-2005-2455",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2005/2455"
        },
        {
          "name": "20051115 Affiliate Network Pro v7.2 SQL Injections, Arbitrary code execution, XSS",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=113209435819541\u0026w=2"
        },
        {
          "name": "17605",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/17605/"
        },
        {
          "name": "affiliate-network-php-code-injection(23076)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/23076"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2005-3796",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Direct static code injection vulnerability in admin_options_manage.php in AlstraSoft Affiliate Network Pro 7.2 allows attackers to execute arbitrary PHP code via the number parameter.  NOTE: it is not clear from the original report whether administrator privileges are required.  If not, then this does not cross privilege boundaries and is not a vulnerability."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://myblog.it-security23.net/?postid=5",
              "refsource": "MISC",
              "url": "http://myblog.it-security23.net/?postid=5"
            },
            {
              "name": "184",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/184"
            },
            {
              "name": "20890",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/20890"
            },
            {
              "name": "ADV-2005-2455",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2005/2455"
            },
            {
              "name": "20051115 Affiliate Network Pro v7.2 SQL Injections, Arbitrary code execution, XSS",
              "refsource": "BUGTRAQ",
              "url": "http://marc.info/?l=bugtraq\u0026m=113209435819541\u0026w=2"
            },
            {
              "name": "17605",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/17605/"
            },
            {
              "name": "affiliate-network-php-code-injection(23076)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/23076"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2005-3796",
    "datePublished": "2005-11-24T11:00:00.000Z",
    "dateReserved": "2005-11-24T00:00:00.000Z",
    "dateUpdated": "2024-08-07T23:24:36.310Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}