PT-2006-3136 · Plogger · Plogger

Publicado 2006-05-03 · Atualizado 2017-07-20 · CVE-2006-2157

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Plogger versions prior to Beta 2.1

Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands via the id parameter in the "gallery.php" file when the level is set to "slideshow".

Recommendations For versions prior to Beta 2.1, avoid using the id parameter in the "gallery.php" file when the level is set to "slideshow" until a fix is available. Consider restricting access to the "gallery.php" file to minimize the risk of exploitation.

Correção

RCE

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2006-2157

Produtos afetados

Plogger

Referências · 4

• http://retrogod.altervista.org/plogger_b21_sql_xpl.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26273 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-2157 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2157 · Nota