Description
WorkforceROI Xpede 4.1 allows remote attackers to execute arbitrary SQL commands and read, modify, or steal credentials from the database via the Qry parameter in the sprc.asp script.
References
- 4555 vdb-entry
- xpede-sprc-sql-injection(8903) vdb-entry
- 20020419 Xpede many vulnerabilities mailing-list