CVE-2005-3208

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2005-10-14 · updated 2026-06-16

Description

Multiple SQL injection vulnerabilities in (1) aeNovo, (2) aeNovoShop and (3) aeNovoWYSI allow remote attackers to execute arbitrary SQL code via (a) the password parameter in control.asp, and (b) the strSQL parameter in search.asp, which can enable XSS attacks in resulting error messages.

Affected products

Aenovo: all versions
Aenovoshop: all versions
Aenovowysi: all versions

References

http://marc.info/?l=bugtraq&m=112872593432359&w=2
http://secunia.com/advisories/17117/
http://www.kapda.ir/advisory-78.html
http://www.osvdb.org/19936
http://www.osvdb.org/19937
http://www.securityfocus.com/bid/15036
http://www.securityfocus.com/bid/15038
https://exchange.xforce.ibmcloud.com/vulnerabilities/22547
https://exchange.xforce.ibmcloud.com/vulnerabilities/22551
https://exchange.xforce.ibmcloud.com/vulnerabilities/22553
http://marc.info/?l=bugtraq&m=112872593432359&w=2
http://secunia.com/advisories/17117/

Get alerted when CVE-2005-3208 or the next vulnerability affects your stack