PT-2006-3231 · Ocean12 · Ocean12 Calendar Manager Pro

Publicado 2006-05-09 · Atualizado 2017-07-20 · CVE-2006-2264

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Ocean12 Calendar Manager Pro version 1.00

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the "date" parameter to the "admin/main.asp" API endpoint, the "SearchFor" parameter to the "admin/view.asp" API endpoint, or the "ID" parameter to the "admin/edit.asp" API endpoint.

Recommendations For Ocean12 Calendar Manager Pro version 1.00, consider restricting access to the "admin/main.asp", "admin/view.asp", and "admin/edit.asp" API endpoints until a patch is available. Avoid using the date, SearchFor, and ID parameters in the respective API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2006-2264

Produtos afetados

Ocean12 Calendar Manager Pro

Referências · 11

• 🔥 https://exploit-db.com/exploits/27826 · Exploit
• 🔥 https://exploit-db.com/exploits/27825 · Exploit
• 🔥 http://securityfocus.com/bid/17877 · Exploit
• 🔥 https://exploit-db.com/exploits/27827 · Exploit
• http://osvdb.org/25344 · Nota
• http://osvdb.org/25346 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-2264 · Nota de Segurança
• http://vupen.com/english/advisories/2006/1705 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26334 · Nota
• http://osvdb.org/25345 · Nota
• http://secunia.com/advisories/20036 · Aviso do Fabricante