PT-2006-2942 · Wwwthreads · Wwwthreads Rc 3

D3Vil-0X1 + 1 · Publicado 2006-04-21 · Atualizado 2018-10-18 · CVE-2006-1958

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions WWWThreads RC 3

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via two methods:

1. the forumreferrer cookie to register.php
2. the messages parameter in message list.php.

Recommendations For WWWThreads RC 3, update the software to prevent SQL injection attacks, specifically by validating and sanitizing user input for the forumreferrer cookie and the messages parameter. As a temporary workaround, consider restricting access to register.php and message list.php to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2006-1958

Produtos afetados

Wwwthreads Rc 3

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2006-1958 · Nota de Segurança
• http://securityfocus.com/bid/17615 · Nota
• http://vupen.com/english/advisories/2006/1447 · Nota
• http://securityreason.com/securityalert/739 · Nota
• http://securityfocus.com/archive/1/431400/100/0/threaded · Nota
• http://secunia.com/advisories/19732 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25936 · Nota