CVE Feed

    Dashboard / CVE / CVE-2011-2149

    CVE-2011-2149

    Multiple SQL injection vulnerabilities in the SmarterTools SmarterStats 6.0 web server allow remote attackers to execute arbitrary SQL commands via certain parameters to (1) Admin/frmSite.aspx, (2) Default.aspx, (3) Services/SiteAdmin.asmx, or (4) Client/frmViewReports.aspx; certain cookies to (5) Services/SiteAdmin.asmx or (6) login.aspx; the Referer HTTP header to (7) Services/SiteAdmin.asmx or (8) login.aspx; or (9) the User-Agent HTTP header to Services/SiteAdmin.asmx.

    Published:May 20, 2011
    Last Modified:Apr 11, 2025
    EPS:May 20, 2011
    EPSS Score:0.00626
    CVSS Score:7.5

    Affected Products

    Vendor
    Smartertools
    Product
    Smarterstats

    Exploits

    No exploit reference

    Related CVEs

    CVE-2017-14620 (CVSS 6.1) — SmarterStats Version 11.3.6347 will Render the Referer Field of HTTP Logfiles from URL /Data/Reports/Referring…
    CVE-2011-4750 (CVSS 4.3) — Multiple cross-site scripting (XSS) vulnerabilities in SmarterTools SmarterStats 6.2.4100 allow remote attacke…
    CVE-2011-4752 (CVSS 10) — SmarterTools SmarterStats 6.2.4100 sends incorrect Content-Type headers for certain resources, which might all…
    CVE-2011-4751 (CVSS 5) — SmarterTools SmarterStats 6.2.4100 generates web pages containing external links in response to GET requests w…
    CVE-2011-2157 (CVSS 5) — The (1) Admin/frmEmailReportSettings.aspx and (2) Admin/frmGeneralSettings.aspx components in the SmarterTools…
    CVE-2011-2150 (CVSS 5) — The SmarterTools SmarterStats 6.0 web server does not properly validate string data that is intended for stora…
    CVE-2011-2153 (CVSS 5) — Login.aspx in the SmarterTools SmarterStats 6.0 web server supports URLs containing txtUser and txtPass parame…
    CVE-2011-2159 (CVSS 10) — The SmarterTools SmarterStats 6.0 web server omits the Content-Type header for certain resources, which might …
    CVE-2011-2148 (CVSS 10) — Admin/frmSite.aspx in the SmarterTools SmarterStats 6.0 web server allows remote attackers to execute arbitrar…
    CVE-2011-2151 (CVSS 5) — The (1) Admin/frmEmailReportSettings.aspx, (2) Admin/frmGeneralSettings.aspx, (3) Admin/frmSite.aspx, (4) Clie…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High