CVE-2004-2023: SQL Injection
Published Dec 31, 2004
·Updated
SQL injection vulnerability in login.php in Zen Cart 1.1.2d, 1.1.4 before patch 1, and possibly other versions allows remote attackers to execute arbitrary SQL via the (1) adminname or (2) adminpass parameters.
Affected Software
2 affected components
Zen Cart Zen Cart=1.1.2d
Zen Cart Zen Cart=1.1.4
Remediation
Patch Available
Event History
Dec 31, 2004
CVE Published
05:00 AM
May 10, 2005
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2004-2023?
CVE-2004-2023 is rated as a critical vulnerability due to its potential to allow arbitrary SQL execution.
2
How do I fix CVE-2004-2023?
To fix CVE-2004-2023, update Zen Cart to the latest version or apply the recommended patches.
3
What versions of Zen Cart are affected by CVE-2004-2023?
CVE-2004-2023 affects Zen Cart versions 1.1.2d and 1.1.4 before patch 1.
4
Can CVE-2004-2023 be exploited remotely?
Yes, CVE-2004-2023 allows remote attackers to exploit the vulnerability through the admin_name or admin_pass parameters.
5
What kind of attack can CVE-2004-2023 facilitate?
CVE-2004-2023 can facilitate SQL injection attacks, enabling attackers to execute arbitrary SQL commands.