« Volver al listado

CVE-2002-1499

Estado: ModificadaAlta (7.5)—

Multiple SQL injection vulnerabilities in FactoSystem CMS allows remote attackers to perform unauthorized database actions via (1) the authornumber parameter in author.asp, (2) the discussblurbid parameter in discuss.asp, (3) the name parameter in holdcomment.asp, and (4) the email parameter in holdcomment.asp.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Factosystem — Factosystem Weblog

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2002-1499",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": true,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2003-04-02T05:00:00.000",
  "references": [
    {
      "url": "http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0097.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://online.securityfocus.com/archive/1/290021",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://sourceforge.net/tracker/index.php?func=detail&aid=602711&group_id=12668&atid=112668",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.iss.net/security_center/static/10000.php",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/5600",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0097.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://online.securityfocus.com/archive/1/290021",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://sourceforge.net/tracker/index.php?func=detail&aid=602711&group_id=12668&atid=112668",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.iss.net/security_center/static/10000.php",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/5600",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple SQL injection vulnerabilities in FactoSystem CMS allows remote attackers to perform unauthorized database actions via (1) the authornumber parameter in author.asp, (2) the discussblurbid parameter in discuss.asp, (3) the name parameter in holdcomment.asp, and (4) the email parameter in holdcomment.asp."
    },
    {
      "lang": "es",
      "value": "Múltiples vulnerabilidades de inyección de SQL en FactoSystem CMS permite a atacantes remotos realizar actividades no autorizadas sobre la base de datos mediante\r\nel parámetro authornumber en author.asp\r\nel parámetro discussblurbid en discuss.asp\r\nel parámetro name en holdcomment.asp, y\r\nel parámetro email e holdcomment.asp"
    }
  ],
  "lastModified": "2026-06-16T21:59:26.543",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:factosystem:factosystem_weblog:0.9b:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "28DE2021-421E-43DB-AC40-42250B80C4B3"
            },
            {
              "criteria": "cpe:2.3:a:factosystem:factosystem_weblog:1.0_beta:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D22DB23C-1B4D-4E13-8FF6-698477D93FD8"
            },
            {
              "criteria": "cpe:2.3:a:factosystem:factosystem_weblog:1.1_beta:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A9811AF8-D769-473A-98ED-6A30E199C734"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}