Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2004-1402: iWebNegar allows attackers to run database commands remotely

CVE-2004-1402 · published 21 years ago

Summary

The iWebNegar web application can be tricked into executing unwanted database actions through its index, comments, or admin login pages. This could let an attacker view, change or delete stored information. Apply the vendor’s security update or ensure all input is strictly validated and access to these pages is limited.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
iwebnegar	iwebnegar	All versions `cpe:2.3:a:iwebnegar:iwebnegar::::::::`

Original advisory text

SQL injection vulnerability in iWebNegar allows remote attackers to execute arbitrary SQL commands via (1) the string parameter for index.php, (2) comments.php, or (3) the administrator login page.

References

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

10.0 Critical

Exploitation

3% chance of attack within 30 days

Timeline

Published31 Dec 2004

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2004-1402 · NVD

Track software like this

Free during beta