CVE-2002-1499

HIGH 7.5CVE-2002-1499 · Published 02/04/2003 · updated 16/06/2026

In short

CVE-2002-1499 is a HIGH (CVSS 7.5) vulnerability affecting factosystem weblog (factosystem).
Chance of exploitation in the next 30 days (EPSS): 2.5%, higher than 84.7% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
factosystem weblog factosystem	`= 0.9b= 1.0_beta= 1.1_beta`	No fix yet

Description

Multiple SQL injection vulnerabilities in FactoSystem CMS allows remote attackers to perform unauthorized database actions via (1) the authornumber parameter in author.asp, (2) the discussblurbid parameter in discuss.asp, (3) the name parameter in holdcomment.asp, and (4) the email parameter in holdcomment.asp.

References

archives.neohapsis.com/archives/vulnwatch/2002-q3/0097.html
online.securityfocus.com/archive/1/290021 · Exploit
sourceforge.net/tracker/index.php
iss.net/security_center/static/10000.php · Vendor Advisory
securityfocus.com/bid/5600 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free