CVE-2002-0555 SQL injection in n/a
Remote attackers can execute arbitrary SQL code via web forms due to improper input unescaping in IBM Informix Web DataBlade.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2002-0555?
CVE-2002-0555 is a high-severity SQL injection vulnerability in n/a, published on 11 Jun 2002. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
IBM Informix Web DataBlade 4.12 unescapes user input even if an application has escaped it, which could allow remote attackers to execute SQL code in a web form even when the developer has attempted to escape it.
Which versions are affected by CVE-2002-0555?
It affects 1 product.
Products include Ibm Informix Web Datablade.
How do I fix CVE-2002-0555?
No fix has been published for CVE-2002-0555 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2002-0555 being exploited?
There is no known exploitation of CVE-2002-0555 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-h6v3-wp3g-7224.