Multiple SQL injection vulnerabilities in Dragonfly Commerce allows remote attackers...

7.5 CVSS

Vulnerability Description

Multiple SQL injection vulnerabilities in Dragonfly Commerce allows remote attackers to modify SQL statements and possibly execute arbitrary SQL commands via the (1) key parameter to dc_Categoriesview.asp, (2) dc_productslist_Clearance.asp, (3) PID parameter to ratings.asp, (4) dc_Productsview.asp, (5) start, (6) key_mp, (7) searchtype, or (8) psearch parameters to dc_forum_Postslist.asp. NOTE: the vendor has disputed this issue, saying that the error messages arise from invalid category and product numbers. Assuming that this is the case, the issue still satisfies the CVE definition of "exposure.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2005-2221

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from incredible interactive

View All →

CVE-2005-2220

Dragonfly Commerce allows remote attackers to change a product price...

Medium 5

Affected Vendor

incredible interactive

View all reports →

Affected Software

dragonfly commerce

Vulnerable Versions:

Unknown

Timeline

Official Publish: July 12th, 2005

Last Modified: August 7th, 2024

Added to House: July 18th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.