Description
The embedded HSQLDB in ParosProxy before 3.2.7, when running with JDK 1.4.2 before 1.4.2_08, allows local users to execute arbitrary comands via crafted SQL commands that interact with HSQLDB through JDBC, a similar vulnerability to CVE-2003-0845.
References
- 20722 vdb-entry
- 147 third-party-advisory
- http://sourceforge.net/project/shownotes.php?release_id=367666&group_id=84378
- 20051104 Parosproxy 3.2.6: Local Exploitation, Command injection vulnerability mailing-list
- [Pen-Test] 20051104 Paros 3.2.7 release mailing-list