CVE-2005-1029

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Multiple SQL injection vulnerabilities in Active Auction House allow remote attackers to execute arbitrary SQL commands via the (1) catid, (2) SortDir, or (3) Sortby parameter to default.asp, (4) itemID parameter to ItemInfo.asp, or (5) Email field to sendpassword.asp.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://digitalparadox.org/advisories/aass.txt
http://marc.info/?l=bugtraq&m=111280834000432&w=2
http://secunia.com/advisories/14839Vendor Advisory
http://www.osvdb.org/15281
http://www.osvdb.org/15282
http://www.osvdb.org/15283
http://www.securityfocus.com/bid/13032Exploit, Vendor Advisory
http://www.securityfocus.com/bid/13034Exploit, Vendor Advisory
http://www.securityfocus.com/bid/13035Vendor Advisory
http://www.securitytracker.com/alerts/2005/Apr/1013649.htmlVendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/19977
http://digitalparadox.org/advisories/aass.txt
http://marc.info/?l=bugtraq&m=111280834000432&w=2
http://secunia.com/advisories/14839Vendor Advisory
http://www.osvdb.org/15281
http://www.osvdb.org/15282
http://www.osvdb.org/15283
http://www.securityfocus.com/bid/13032Exploit, Vendor Advisory
http://www.securityfocus.com/bid/13034Exploit, Vendor Advisory
http://www.securityfocus.com/bid/13035Vendor Advisory
http://www.securitytracker.com/alerts/2005/Apr/1013649.htmlVendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/19977

Timeline

Published: Apr 6, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2005

CVE-2005-10304.3Multiple cross-site scripting (XSS) vulnerabilities in Active Auction House allow remote attackers to inject arbitrary web script or HTML vi CVE-2005-10315.0RUNCMS 1.1A, and possibly other products based on e-Xoops (exoops), when "Allow custom avatar upload" is enabled, does not properly verify u CVE-2005-10335.0CubeCart 2.0.6 allows remote attackers to obtain sensitive information via an invalid (1) language parameter to index.php, (2) PHPSESSID par CVE-2005-10345.0SurgeFTP 2.2m1 allows remote attackers to cause a denial of service (application hang) via the LEAK command.CVE-2005-10357.5Multiple buffer overflows in Pavuk before 0.9.32 have unknown attack vectors and impact.CVE-2005-10367.8FreeBSD 5.x to 5.4 on AMD64 does not properly initialize the IO permission bitmap used to allow user access to certain hardware, which allow CVE-2005-103710.0Unknown vulnerability in AIX 5.3.0, when configured as an NIS client, allows remote attackers to gain root privileges.CVE-2005-10382.1crontab in Vixie cron 4.1, when running with the -e option, allows local users to read the cron files of other users by changing the file be CVE-2005-10393.7Race condition in Core Utilities (coreutils) 5.2.1, when (1) mkdir, (2) mknod, or (3) mkfifo is running with the -m switch, allows local use CVE-2005-10407.2Multiple unknown vulnerabilities in netapplet in Novell Linux Desktop 9 allow local users to gain root privileges, related to "User input [b CVE-2005-10412.1The fib_seq_start function in fib_hash.c in Linux kernel allows local users to cause a denial of service (system crash) via /proc/net/route.CVE-2005-10427.5Integer overflow in the exif_process_IFD_TAG function in exif.c in PHP before 4.3.11 may allow remote attackers to execute arbitrary code vi