CVE-2004-2175

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Multiple SQL injection vulnerabilities in ReviewPost PHP Pro allow remote attackers to execute arbitrary SQL commands via the (1) product parameter to showproduct.php or (2) cat parameter to showcat.php.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/10786/Patch, Vendor Advisory
http://www.securityfocus.com/archive/1/352598Exploit, Patch
http://www.securityfocus.com/bid/9574Exploit
http://www.zone-h.org/en/advisories/read/id=3864/Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/15035
http://secunia.com/advisories/10786/Patch, Vendor Advisory
http://www.securityfocus.com/archive/1/352598Exploit, Patch
http://www.securityfocus.com/bid/9574Exploit
http://www.zone-h.org/en/advisories/read/id=3864/Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/15035

Timeline

Published: Dec 31, 2004
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2004

CVE-2004-21764.6The Internet Connection Firewall (ICF) in Microsoft Windows XP SP2 is configured by default to trust sessmgr.exe, which allows local users t CVE-2004-21774.3Cross-site scripting (XSS) vulnerability in DevoyBB Web Forum 1.0.0 allows remote attackers to inject arbitrary web script or HTML via unkno CVE-2004-21787.5SQL injection vulnerability in DevoyBB Web Forum 1.0.0 allows remote attackers to execute arbitrary SQL commands via unknown vectors.CVE-2004-21795.0asycpict.dll, as used in Microsoft products such as Front Page 97 and 98, allows remote attackers to cause a denial of service (hang) via a CVE-2004-21804.3Multiple cross-site scripting (XSS) vulnerabilities in WowBB Forum 1.61 allow remote attackers to inject arbitrary web script or HTML via th CVE-2004-21817.5Multiple SQL injection vulnerabilities in WowBB Forum 1.61 allow remote attackers to execute arbitrary SQL commands via the (1) sort_by or (CVE-2004-21827.5Session fixation vulnerability in Macromedia JRun 4.0 allows remote attackers to hijack user sessions by pre-setting the user session ID inf CVE-2004-21837.5Unknown vulnerability in WeHelpBUS 0.1 allows remote attackers to execute arbitrary shell commands via the query string.CVE-2004-21846.4Directory traversal vulnerability in Digicraft Yak! server 2.0 through 2.1.2 allows remote attackers to read or write arbitrary files via ".CVE-2004-21856.8Multiple cross-site scripting (XSS) vulnerabilities in MediaWiki 1.3.5 allow remote attackers to execute arbitrary scripts and/or SQL querie CVE-2004-21867.5SQL injection vulnerability in MediaWiki 1.3.5 allows remote attackers to execute arbitrary SQL commands via SpecialMaintenance.CVE-2004-21875.0Unknown vulnerability in ImagePage for MediaWiki 1.3.5, related to "filename validation," has unknown impact and attack vectors.