CVE ID:	CVE-2004-1553
Description:	SQL injection vulnerability in aspWebAlbum allows remote attackers to execute arbitrary SQL statements via (1) the username field on the login page or (2) the cat parameter to album.asp. NOTE: it was later reported that vector 1 affects aspWebAlbum 3.2, and the vector involves the txtUserName parameter in a processlogin action to album.asp, as reachable from the login action.
Test IDs:	None available
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2004-1553 BugTraq ID: 11246 http://www.securityfocus.com/bid/11246 BugTraq ID: 30996 http://www.securityfocus.com/bid/30996 Bugtraq: 20040923 aspWebCalendar /aspWebAlbum: SQL injection (Google Search) http://marc.info/?l=bugtraq&m=109604910025090&w=2 https://www.exploit-db.com/exploits/6357 https://www.exploit-db.com/exploits/6420 http://osvdb.org/47913 http://osvdb.org/47914 http://secunia.com/advisories/31649 XForce ISS Database: aspwebalbum-album-sql-injection(44877) https://exchange.xforce.ibmcloud.com/vulnerabilities/44877 XForce ISS Database: aspwebalbum-image-file-upload(44876) https://exchange.xforce.ibmcloud.com/vulnerabilities/44876 XForce ISS Database: aspwebalbum-sql-injection(17507) https://exchange.xforce.ibmcloud.com/vulnerabilities/17507