$ cve CVE-2004-1553 JSON

CVE-2004-1553 EXPLOIT

7.5

HIGH · CVSS 2.0 · EPSS 2.4% (pctl 83)

Patch early

A public exploit exists.

Description

SQL injection vulnerability in aspWebAlbum allows remote attackers to execute arbitrary SQL statements via (1) the username field on the login page or (2) the cat parameter to album.asp. NOTE: it was later reported that vector 1 affects aspWebAlbum 3.2, and the vector involves the txtUserName parameter in a processlogin action to album.asp, as reachable from the login action.

Scoring

CVSS	7.5 (HIGH, v2.0)
Vector	AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS	2.38% — more likely to be exploited than 83% of all CVEs
Weakness	CWE-89
On CISA KEV	no
Public exploit	yes
Published	2004-12-31
Last modified	2026-06-16

Affected (1)

Vendor	Product
fullrevolution	aspwebalbum

Public exploits

Source	Title	Date
exploit-db	aspwebalbum 3.2 - Multiple Vulnerabilities	2008-09-10
exploit-db	aspwebalbum 3.2 - Arbitrary File Upload / SQL Injection / Cross-Site Scripting	2008-09-03

References

→ the Explorer · watch your stack · NVD