CVE-2004-2067 json
SQL injection vulnerability in controlpanel.php in Jaws Framework and Content Management System 0.4 allows remote attackers to execute arbi…
published 2004-07-29 22 y ago modified 2026-06-16 4 mo ago also EUVD-2004-2059
- cvss
- 7.5
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.8%
- EPSS 2.8% chance of exploitation in 30 days, percentile 86%
- public exploits
- 1
- Exploit-DB
Summary
SQL injection vulnerability in controlpanel.php in Jaws Framework and Content Management System 0.4 allows remote attackers to execute arbitrary SQL and bypass authentication via the (1) user, (2) password, or (3) crypted_password parameters.
Timeline
- First public exploit (EDB-24334)
- Published
Exploit prediction
2.79% chance of exploitation in the next 30 days, higher than 86% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-24334 Jaws 0.2/0.3/0.4 - 'ControlPanel.php' SQL Injection webapps, 2004-07-29
- securityfocus.com http://www.securityfocus.com/bid/10826 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
References
-
securityfocus.com
/bid/10826
vdb-entry, exploit, vendor-advisory
- jaws.com.mx /index.php?gadget=blog&action=single_view&id=10
-
marc.info
/?l=bugtraq&m=109116345930380&w=2
mailing-list
-
osvdb.org
/8320
vdb-entry
-
securitytracker.com
/id?1010815
vdb-entry
-
exchange.xforce.ibmcloud.com
/vulnerabilities/16847
vdb-entry
Sources
- CVE List CVE-2004-2067
- NVD CVE-2004-2067
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.