CVE-2004-1893

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2004-12-31 · updated 2026-06-16

Description

Dreamweaver MX, when "Using Driver On Testing Server" or "Using DSN on Testing Server" is selected, uploads the mmhttpdb.asp script to the web site but does not require authentication, which allows remote attackers to obtain sensitive information and possibly execute arbitrary SQL commands via a direct request to mmhttpdb.asp.

References

http://marc.info/?l=bugtraq&m=108102481929451&w=2
http://secunia.com/advisories/11284
http://www.macromedia.com/devnet/security/security_zone/mpsb04-05.html
http://www.nextgenss.com/advisories/dreamweaver.txt
http://www.securityfocus.com/bid/10036
https://exchange.xforce.ibmcloud.com/vulnerabilities/15721
http://marc.info/?l=bugtraq&m=108102481929451&w=2
http://secunia.com/advisories/11284
http://www.macromedia.com/devnet/security/security_zone/mpsb04-05.html
http://www.nextgenss.com/advisories/dreamweaver.txt
http://www.securityfocus.com/bid/10036
https://exchange.xforce.ibmcloud.com/vulnerabilities/15721

Get alerted when CVE-2004-1893 or the next vulnerability affects your stack