CVE-2004-2324

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2004-12-31 · updated 2026-06-16

Description

SQL injection vulnerability in DotNetNuke (formerly IBuySpy Workshop) 1.0.6 through 1.0.10d allows remote attackers to modify the backend database via the (1) table and (2) field parameters in LinkClick.aspx.

Affected products

DotNetNuke CMS Fixed in 9.1.1: 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10d

References

http://archives.neohapsis.com/archives/fulldisclosure/2004-01/1161.html
http://secunia.com/advisories/10747
http://www.osvdb.org/3750
http://www.securityfocus.com/bid/9518
https://exchange.xforce.ibmcloud.com/vulnerabilities/14973
http://archives.neohapsis.com/archives/fulldisclosure/2004-01/1161.html
http://secunia.com/advisories/10747
http://www.osvdb.org/3750
http://www.securityfocus.com/bid/9518
https://exchange.xforce.ibmcloud.com/vulnerabilities/14973

Get alerted when CVE-2004-2324 or the next vulnerability affects your stack