CVE-2004-1647

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2004-08-30 · updated 2026-06-16

Description

SQL injection vulnerability in Password Protect allows remote attackers to execute arbitrary SQL statements and bypass authentication via (1) admin or Pass parameter to index_next.asp, (2) LoginId, OPass, or NPass to CPassChangePassword.asp, (3) users_edit.asp, or (4) users_add.asp.

Affected products

Web Animations Password Protect: all versions

References

http://marc.info/?l=bugtraq&m=109414967003192&w=2
http://secunia.com/advisories/12407
http://www.criolabs.net/advisories/passprotect.txt
http://www.securityfocus.com/bid/11073
https://exchange.xforce.ibmcloud.com/vulnerabilities/17188
http://marc.info/?l=bugtraq&m=109414967003192&w=2
http://secunia.com/advisories/12407
http://www.criolabs.net/advisories/passprotect.txt
http://www.securityfocus.com/bid/11073
https://exchange.xforce.ibmcloud.com/vulnerabilities/17188

Get alerted when CVE-2004-1647 or the next vulnerability affects your stack