CVE-2002-0581

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

WorkforceROI Xpede 4.1 allows remote attackers to execute arbitrary SQL commands and read, modify, or steal credentials from the database via the Qry parameter in the sprc.asp script.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://archives.neohapsis.com/archives/bugtraq/2002-04/0273.htmlPatch, Vendor Advisory
http://www.iss.net/security_center/static/8903.phpVendor Advisory
http://www.securityfocus.com/bid/4555Vendor Advisory
http://archives.neohapsis.com/archives/bugtraq/2002-04/0273.htmlPatch, Vendor Advisory
http://www.iss.net/security_center/static/8903.phpVendor Advisory
http://www.securityfocus.com/bid/4555Vendor Advisory

Timeline

Published: Jun 18, 2002
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2002

CVE-2002-05825.0WorkforceROI Xpede 4.1 stores temporary expense claim reports in a world-readable and indexable /reports/temp directory, which allows remote CVE-2002-05835.0WorkforceROI Xpede 4.1 uses a small random namespace (5 alphanumeric characters) for temporary expense claim reports in the /reports/temp di CVE-2002-05845.0WorkforceROI Xpede 4.1 allows remote attackers to read user timesheets by modifying the TSN ID parameter to the ts_app_process.asp script, w CVE-2002-05855.0Unknown vulnerability in ndd for HP-UX 11.11 with certain TRANSPORT patches allows attackers to cause a denial of service.CVE-2002-05867.5Format string vulnerability in Ns_PdLog function for the external database driver proxy daemon library (libnspd.a) of AOLServer 3.0 through CVE-2002-05877.5Buffer overflow in Ns_PdLog function for the external database driver proxy daemon library (libnspd.a) of AOLServer 3.0 through 3.4.2 allows CVE-2002-05885.0PVote before 1.9 does not authenticate users for restricted operations, which allows remote attackers to add or delete polls by modifying pa CVE-2002-05897.5PVote before 1.9 allows remote attackers to change the administrative password and gain privileges by directly calling ch_info.php with the CVE-2002-05907.5Cross-site scripting (CSS) vulnerability in IcrediBB 1.1 Beta allows remote attackers to execute arbitrary script and steal cookies as other CVE-2002-05915.0Directory traversal vulnerability in AOL Instant Messenger (AIM) 4.8 beta and earlier allows remote attackers to create arbitrary files and CVE-2002-05927.5AOL Instant Messenger (AIM) allows remote attackers to steal files that are being transferred to other clients by connecting to port 4443 (D CVE-2002-05937.5Buffer overflow in Netscape 6 and Mozilla 1.0 RC1 and earlier allows remote attackers to cause a denial of service (crash) and possibly exec