PT-2006-3519 · Dgbook · Dgbook

Publicado 2006-05-24 · Atualizado 2017-07-20 · CVE-2006-2573

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions DGBook version 1.0

Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands. This is possible via the name, email, homepage, address, comment, and ip parameters in index.php when magic quotes gpc is disabled.

Recommendations For DGBook version 1.0, consider disabling the use of the vulnerable parameters (name, email, homepage, address, comment, and ip) in index.php until a patch is available. Additionally, enabling magic quotes gpc can help mitigate this issue.

Correção

Identificadores relacionados

CVE-2006-2573

Produtos afetados

Dgbook

Referências · 5

• http://vupen.com/english/advisories/2006/1942 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26630 · Nota
• http://secunia.com/advisories/20201 · Aviso do Fabricante
• http://osvdb.org/25733 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-2573 · Nota de Segurança