PT-2006-1282 · Wordcircle · Wordcircle

Aliaksandr Hartsuyeu · Publicado 2006-01-13 · Atualizado 2018-10-19 · CVE-2006-0205

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Wordcircle version 2.17

Description The issue allows remote attackers to execute arbitrary SQL commands and bypass authentication via the password field in the login action to "index.php" (involving v login.php and s user.php). It may also have other unknown impact via certain other fields in unspecified scripts.

Recommendations For Wordcircle version 2.17, consider restricting access to the login action in "index.php" and validating user input in the password field to prevent SQL injection attacks. As a temporary workaround, restrict access to v login.php and s user.php to minimize the risk of exploitation. Avoid using user-supplied input in SQL queries until the issue is resolved.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2006-0205

Produtos afetados

Wordcircle

Referências · 13

• 🔥 http://osvdb.org/22358 · Exploit
• 🔥 http://evuln.com/vulns/27/summary.html · Exploit
• 🔥 http://evuln.com/vulns/28/summary.html · Exploit
• http://secunia.com/advisories/18440 · Aviso do Fabricante
• http://securityreason.com/securityalert/345 · Nota
• http://securityfocus.com/archive/1/421746/100/0/threaded · Nota
• http://vupen.com/english/advisories/2006/0185 · Aviso do Fabricante
• http://securityfocus.com/bid/16227 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24105 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24108 · Nota
• http://securityfocus.com/archive/1/421745/100/0/threaded · Nota
• http://securityreason.com/securityalert/346 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-0205 · Nota de Segurança