Geheimchaos · Geheimchaos · CVE-2006-4118
**Name of the Vulnerable Software and Affected Versions**
GeheimChaos versions 0.5 and earlier
**Description**
The issue allows remote attackers to execute arbitrary SQL commands. This is possible via the `Temp entered login` or `Temp entered email` parameters to "gc.php", and in multiple parameters in "include/registrieren.php", possibly involving the variables `form email`, `form vorname`, `form nachname`, `form strasse`, `form plzort`, `form land`, `form homepage`, `form bildpfad`, `form profilsichtbar`, `Temp sprache`, `form tag`, `form monat`, `form jahr`, `Temp akt string`, `form icq`, `form msn`, `form yahoo`, `form username`, and `Temp form pass`.
**Recommendations**
For GeheimChaos versions 0.5 and earlier, consider disabling the SQL execution functionality or restricting access to the "gc.php" and "include/registrieren.php" files until a patch is available. Avoid using the vulnerable parameters in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.